CVE-2024-2025 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request

🗓️ 23 Mar 2024 01:57:39Reported by WordfenceType

WordPress plugin vulnerable to PHP Object Injection in get_simple_request function, allowing authenticated attackers to inject PHP Object

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress Plugin BuddyPress WooCommerce My Account Integration 安全漏洞	23 Mar 202400:00	–	cnnvd
CVE	CVE-2024-2025	23 Mar 202401:57	–	cve
EUVD	EUVD-2024-26995	3 Oct 202520:07	–	euvd
NVD	CVE-2024-2025	23 Mar 202402:15	–	nvd
Patchstack	WordPress WooBuddy Plugin <= 3.4.20 is vulnerable to PHP Object Injection	25 Mar 202400:00	–	patchstack
Positive Technologies	PT-2024-18637 · WordPress · Buddypress Woocommerce My Account Integration	22 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-2025	7 Jan 202609:09	–	redhatcve
Vulnrichment	CVE-2024-2025 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request	23 Mar 202401:57	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 18, 2024 to March 24, 2024)	28 Mar 202415:35	–	wordfence
WPVulnDB	BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages < 3.4.21 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request	22 Mar 202400:00	–	wpvulndb

[
  {
    "vendor": "themekraft",
    "product": "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.4.20",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3055634/wc4bp/trunk/class/includes/class-request-helper.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/78da9e79-399e-43e3-ac27-a162861cae71

08 Apr 2026 17:01Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

EPSS0.00821

CWE-502

buddypress woocommerce my account integration" "wordpress" "php object injection" "authenticated attackers" "subscriber-level access" "pop chain" "arbitrary files deletion" "sensitive data retrieval" "code execution