CVE-2024-12312 describes a PHP Object Injection vulnerability in the Print Science Designer WordPress plugin (versions up to 1.3.152). The issue arises from unsafe deserialization of the 'designer-saved-projects' cookie, which accepts untrusted input. Without a known POP chain in the plugin itself, exploitation requires additional vulnerable components to achieve impactful outcomes such as arbitrary file deletion, data leakage, or remote code execution. The vulnerability is remotely exploitable without authentication but requires high attack complexity.

Successful exploitation could lead to high impact outcomes including confidentiality, integrity, and availability breaches. Specifically, attackers could delete arbitrary files, retrieve sensitive information, or execute arbitrary code if a suitable POP chain is present in the environment. The vulnerability affects all users of the plugin up to version 1.3.152, potentially compromising WordPress sites using this plugin alongside other vulnerable components.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and consider disabling or removing the Print Science Designer plugin until a fix is released. Additionally, review other installed plugins and themes for potential POP chains that could be leveraged in exploitation. Applying general security best practices such as limiting plugin usage and maintaining least privilege may reduce risk but do not directly mitigate this vulnerability.