CVE-2024-37212 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - CSRF to PHP Object Injection vulnerability

Q: What is CVE-2024-37212?

CVE-2024-37212 is a high-severity vulnerability in Ali2Woo Lite, published on 21 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Q: Is CVE-2024-37212 being exploited?

There is no known exploitation of CVE-2024-37212 in the wild and no public exploit code.

Q: How do I fix CVE-2024-37212?

No fix has been published for CVE-2024-37212 yet. Limit exposure of the affected software until one is available.

High 8.3 Published 21 Jun 2024 Updated 28 Apr 2026

Attackers can exploit CSRF to trigger PHP object injection in the Ali2Woo Lite WordPress plugin, potentially leading to code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-37212?

CVE-2024-37212 is a high-severity vulnerability in Ali2Woo Lite, published on 21 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-Site Request Forgery (CSRF) vulnerability in Ali2Woo Ali2Woo Lite.This issue affects Ali2Woo Lite: from n/a through 3.3.5.

Weakness: CWE-352

Which versions are affected by CVE-2024-37212?

It affects 1 product.

Products include Ali2woo Aliexpress Dropshipping With Alinext.

How do I fix CVE-2024-37212?

No fix has been published for CVE-2024-37212 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-37212 being exploited?

There is no known exploitation of CVE-2024-37212 in the wild and no public exploit code.

Sources

Also known as GHSA-fr2r-x4wp-q45h.