CVE-2024-35728
📋 TL;DR
This CVE describes a code injection vulnerability in the PPOM for WooCommerce WordPress plugin. Attackers can inject malicious code that gets executed by downstream components, potentially leading to arbitrary code execution. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- PPOM for WooCommerce (WordPress plugin)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete site compromise, data theft, malware installation, or site defacement.
Likely Case
Content injection leading to site defacement, SEO spam injection, or limited code execution within WordPress context.
If Mitigated
No impact if plugin is patched or disabled, or if input validation prevents exploitation.
🎯 Exploit Status
Injection vulnerabilities in WordPress plugins are frequently exploited. While no public PoC is confirmed, similar vulnerabilities are often weaponized quickly.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 32.0.21 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'PPOM for WooCommerce'. 4. Click 'Update Now' if available. 5. Alternatively, download version 32.0.21+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable PPOM Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate woocommerce-product-addon
Restrict User Access
allLimit plugin management to trusted administrators only.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block injection attempts
- Disable the PPOM plugin entirely and use alternative WooCommerce addon solutions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for PPOM for WooCommerce version. If version is 32.0.20 or lower, you are vulnerable.Check Version:
wp plugin get woocommerce-product-addon --field=versionVerify Fix Applied:
After updating, verify plugin version shows 32.0.21 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to PPOM-related endpoints
- Unexpected file modifications in wp-content/plugins/woocommerce-product-addon
Network Indicators:
- HTTP requests containing suspicious injection payloads to PPOM endpoints
SIEM Query:
source="wordpress.log" AND ("PPOM" OR "woocommerce-product-addon") AND ("injection" OR "eval" OR "base64_decode")🔗 References
- https://patchstack.com/database/vulnerability/woocommerce-product-addon/wordpress-product-addons-fields-for-woocommerce-plugin-32-0-20-content-injection-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/woocommerce-product-addon/wordpress-product-addons-fields-for-woocommerce-plugin-32-0-20-content-injection-vulnerability?_s_id=cve
