CVE-2024-11465

The Custom Product Tabs for WooCommerce plugin is susceptible to PHP Object Injection through deserialization of unverified data in the 'yikes_woo_products_tabs' post meta field in versions 1.8.5 and earlier. Authenticated users with Shop Manager privileges or higher can inject malicious PHP objects, though exploitation depends on a POP chain being available from another plugin or theme on the system. If such a chain exists, an attacker could execute arbitrary code, access sensitive information, or remove files from the server. The vulnerability was resolved in version 1.8.6.

Based on public CVE data (MITRE/NVD).