CVE-2024-5335

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5335
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_compare_products cookie in versions up to , and including, 1.6.4. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to delete arbitrary files, retrieve sensitive data, or execute code.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae44bcb-6149-4661-8890-23c867e9a918?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/ultimate-store-kit/trunk/includes/helper.php#L1103 Product
https://plugins.trac.wordpress.org/changeset/3135472/ultimate-store-kit/trunk/includes/helper.php Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:bdthemes:ultimate_store_kit:*:*:*:*:free:wordpress:*:*
History

10 Jul 2025, 15:31

Type Values Removed Values Added
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae44bcb-6149-4661-8890-23c867e9a918?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae44bcb-6149-4661-8890-23c867e9a918?source=cve - Third Party Advisory
References () https://plugins.trac.wordpress.org/browser/ultimate-store-kit/trunk/includes/helper.php#L1103 - () https://plugins.trac.wordpress.org/browser/ultimate-store-kit/trunk/includes/helper.php#L1103 - Product
References () https://plugins.trac.wordpress.org/changeset/3135472/ultimate-store-kit/trunk/includes/helper.php - () https://plugins.trac.wordpress.org/changeset/3135472/ultimate-store-kit/trunk/includes/helper.php - Patch
First Time Bdthemes ultimate Store Kit
Bdthemes
CPE cpe:2.3:a:bdthemes:ultimate_store_kit:*:*:*:*:free:wordpress:*:*

21 Aug 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-21 09:15

Updated : 2025-07-10 15:31

NVD link : CVE-2024-5335

Mitre link : CVE-2024-5335

JSON object : View

Products Affected

bdthemes

  • ultimate_store_kit
CWE

No CWE.