CVE-2024-4371

CVE-2024-4371 is a critical PHP Object Injection vulnerability affecting all versions up to 4.4.1 of the CoDesigner WooCommerce Builder for Elementor WordPress plugin. This flaw allows unauthenticated attackers to inject PHP objects by manipulating the recently_viewed_products cookie. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability if a suitable POP chain exists on the target system. While the vulnerable plugin itself lacks a POP chain, other installed plugins or themes could provide the necessary components for arbitrary file deletion, sensitive data retrieval, or code execution. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Despite a single community mention, the vulnerability is not on the CISA KEV catalog or the Hot List, suggesting it is not widely discussed or exploited at this time.