CVE-2024-13831

CVE-2024-13831 is a PHP Object Injection vulnerability affecting the Tabs for WooCommerce WordPress plugin, versions up to and including 1.0.0. It allows authenticated attackers with Shop Manager-level access or higher to inject a PHP Object through deserialization of untrusted input in the 'product_has_custom_tabs' function. The vulnerability has a CVSS score of 7.2 (HIGH), indicating high impact on confidentiality, integrity, and availability if a suitable POP chain is present. While the vulnerability itself lacks a known POP chain, its impact becomes critical if another plugin or theme on the system provides one, potentially leading to arbitrary file deletion, sensitive data retrieval, or code execution. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Its EPSS score is low, suggesting a low probability of exploitation in the wild.