CVE-2024-12627: 
WordPress vulnerability analysis and mitigation

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-12627) affecting all versions up to and including 1.3.5. The vulnerability was disclosed on January 10, 2025 (NVD).

The vulnerability stems from the deserialization of untrusted input from post content passed to the capture_email AJAX action. The severity is rated as HIGH with a CVSS v3.1 base score of 7.5 (Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) (NVD, Wordfence).

If exploited, this vulnerability could allow authenticated attackers with Contributor-level access or higher to inject PHP Objects. While no known POP chain is present in the vulnerable software itself, if a POP chain exists via additional plugins or themes on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code (NVD).

Users should update to a version newer than 1.3.5 when available. A patch has been implemented as evidenced by the changes in the WordPress plugin repository (WordPress Plugin).