What the vulnerability does
01Description
The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently_viewed_products cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
CoDesigner versions up to 4.4.1 contain a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on affected WordPress sites. The vulnerability requires specific conditions to trigger but can compromise the entire site when exploited. Site administrators should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site and take full control of it.
Potential impact on your site
04Site Impact
Complete site compromise including data theft, malware installation, and loss of availability.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required, though exploitation requires specific conditions.
Key dates
06Disclosure timeline
June 13, 2024
CVE published
April 8, 2026
Record updated
