critical CVSS 9.8

CVE-2024-5335·PHP vulnerability

The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_compare_products cookie in versions up to , and including, 1.6.4. This makes it possible for an unauthenticated attacker to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker or above to delete arbitrary files, retrieve sensitive data, or execute code.

Severity
critical
Software
PHP
Fixed in
2.0.0
Published
2024-08-21

Affected versions

Until: 2.0.0

Fixed in: 2.0.0

How to fix this CVE

Update the Ultimate Store Kit Elementor Addons plugin to version 2.0.0 or later immediately to patch the PHP object injection vulnerability in the cookie deserialization handler. Ensure all dependent PHP installations and web application firewall rules are reviewed for signs of exploitation before and after patching. Conduct a security audit of your WordPress environment to identify any additional POP chain gadgets introduced by other plugins or themes that could amplify the attack surface.

sudo dnf update php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /wp-content/plugins/ultimate-store-kit/ HTTP/1.1.*Cookie:.*_ultimate_store_kit_compare_products=O:[0-9]+:"[^"]+":[0-9]+:\{

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Configure your WAF to block HTTP requests containing the _ultimate_store_kit_compare_products cookie with serialized PHP object patterns (regex: O:[0-9]+:). Additionally, block cookie values exceeding typical product comparison data size thresholds (>2KB) to prevent deserialization attacks before they reach the application layer.

How to check if you are affected

  1. Check the installed version of the Ultimate Store Kit plugin: In WordPress admin dashboard, navigate to Plugins and locate 'Ultimate Store Kit' to verify the current version number.
  2. Confirm if the plugin is actively in use by checking if the _ultimate_store_kit_compare_products cookie is being set: Use browser developer tools (F12 → Application → Cookies) on your WordPress site and filter for '_ultimate_store_kit_compare_products'.
  3. Search access logs for serialized PHP object patterns in cookie values: grep -i '_ultimate_store_kit_compare_products' /var/log/apache2/access.log | grep -i 'O:[0-9]' to detect potential object injection attempts.
  4. Verify the patch was applied by confirming plugin version ≥ 2.0.0 in the WordPress admin dashboard, then restart PHP-FPM: sudo systemctl restart php-fpm

FAQ

What is CVE-2024-5335?

CVE-2024-5335 is a critical PHP object injection vulnerability in the Ultimate Store Kit Elementor Addons plugin (versions up to 1.6.4) that allows unauthenticated attackers to inject malicious serialized PHP objects through the _ultimate_store_kit_compare_products cookie. If other vulnerable plugins or themes with POP chains are present, attackers could escalate this to arbitrary file deletion, data theft, or remote code execution.

Is CVE-2024-5335 being actively exploited?

No, CVE-2024-5335 is not listed on the CISA Known Exploited Vulnerabilities catalog and no public exploits have been disclosed as of the advisory date. However, the vulnerability remains highly critical due to its CVSS 9.8 score and the low barrier to exploitation.

What versions of the Ultimate Store Kit plugin are affected by CVE-2024-5335?

All versions up to and including 1.6.4 are vulnerable. Version 2.0.0 and later contain the security fix.

How do I check if my WordPress site is vulnerable to CVE-2024-5335?

Log into your WordPress admin dashboard, navigate to Plugins, and check the version of 'Ultimate Store Kit Elementor Addons' listed. If the version is 1.6.4 or lower, your site is vulnerable and requires immediate patching to 2.0.0 or later.

Does Defensia detect CVE-2024-5335?

Yes — Defensia's CVE advisory scanner compares installed plugin versions against the NVD database. If the Ultimate Store Kit plugin is installed on a monitored WordPress server, CVE-2024-5335 will appear in your dashboard with remediation steps and automatic update recommendations.

Related PHP CVEs

CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-5335. Free for 1 server.

Get started free