CVE-2024-12600: 
WordPress vulnerability analysis and mitigation

The Custom Product Tabs Lite for WooCommerce plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-12600) affecting all versions up to and including 1.9.0. The vulnerability was discovered and reported by Wordfence, with disclosure on January 25, 2025 (NVD CVE).

The vulnerability stems from the unsafe deserialization of untrusted input from the 'frswooproduct_tabs' parameter. The issue has been assigned a CVSS v3.1 base score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) (NVD CVE).

While no known POP (Property-Oriented Programming) chain exists in the vulnerable software itself, if a POP chain is present through additional plugins or themes installed on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code on the affected system (NVD CVE).

A patch has been released to address this vulnerability. Users are advised to update their Custom Product Tabs Lite for WooCommerce plugin to the latest version (Wordfence).