CVE-2024-10828

CVE-2024-10828 is a critical PHP Object Injection vulnerability affecting the Advanced Order Export For WooCommerce plugin for WordPress, impacting all versions up to and including 3.5.5. This flaw allows unauthenticated attackers to inject PHP Objects through deserialization of untrusted input during order exports, specifically when the "Try to convert serialized values" option is enabled. With a CVSS score of 9.8 (CRITICAL), successful exploitation can lead to arbitrary file deletion, potentially resulting in remote code execution by targeting critical files like wp-config.php. Despite its high severity and EPSS score, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.