CVE-2024-4371 is a Critical (CVSS 9.0) PHP object injection in CoDesigner WooCommerce Builder for Elementor, versions up to and including 4.4.1. The plugin deserializes the recently_viewed_products cookie. The record says no known gadget chain exists in the plugin itself. Update to a newer version.
What's affected
- Product: CoDesigner WooCommerce Builder for Elementor by Codexpert, a WordPress plugin. The code repository name in the record's changeset link is woolementor.
- Affected versions: all up to and including 4.4.1.
- Fixed version: not named in the record. A Trac changeset (3099922) is linked and I did not fetch it. Use the current release.
- Severity: Critical, CVSS 9.0. The vector shows high attack complexity and a changed scope.
- Entry point: deserialization of untrusted input from the recently_viewed_products cookie.
- Exploitation: KEV is false.
How to check if you're exposed
Check the plugin version:
wp plugin list --fields=name,version,status | grep -i -E "codesigner|woolementor"
The plugin's folder name can differ, so check the plugin list in the dashboard as well. The record's key point is that the plugin on its own has no known chain, so your real exposure depends on what else is installed. Any plugin or theme with a usable gadget chain raises the risk. List installed plugins and themes and check them for their own advisories.
What to do now
- Update CoDesigner to the latest release.
- Update every other plugin and theme, since a gadget chain in any of them is what turns this into file deletion or code execution.
- Remove plugins and themes you do not use.
- Review web logs for unusual values in the recently_viewed_products cookie.
- Run a dependency scan across your site's components to find other components with known advisories.
Why it matters
The record maps this to CWE-502, deserialization of untrusted data. PHP can rebuild objects from text. If an attacker supplies that text, they choose the object that is created, and its cleanup methods may do something harmful when they run.
That is why the record talks about a POP chain, a sequence of existing classes whose methods can be strung together. The plugin alone has none, but the site as a whole might. The fix is to stop unserializing cookie data, and to use plain data formats such as JSON.
Quick check
What is a POP chain?
A property oriented programming chain is a set of existing classes whose automatic methods can be combined by a crafted object to do harm. Without one, object injection has little effect.
Am I safe if the plugin has no chain?
Not necessarily. Another plugin or theme on the same site may provide one, as the record warns.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4371 (published 2024-06-13) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
