CVE-2024-12627: 
WordPress vulnerability analysis and mitigation

The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-12627) affecting all versions up to and including 1.3.5. The vulnerability was disclosed on January 10, 2025 (NVD).

The vulnerability stems from the deserialization of untrusted input from post content passed to the capture_email AJAX action. The severity is rated as HIGH with a CVSS v3.1 base score of 7.5 (Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) (NVD, Wordfence).

If exploited, this vulnerability could allow authenticated attackers with Contributor-level access or higher to inject PHP Objects. While no known POP chain is present in the vulnerable software itself, if a POP chain exists via additional plugins or themes on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code (NVD).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. The attack complexity is considered HIGH, but no user interaction is required once the attacker has the necessary privileges (NVD).

Users should update to a version newer than 1.3.5 when available. A patch has been implemented as evidenced by the changes in the WordPress plugin repository (WordPress Plugin).