CVE-2024-12313 is a deserialization vulnerability (CWE-502) in the Compare Products for WooCommerce plugin for WordPress. It arises from unsafe deserialization of the 'woo_compare_list' cookie, allowing unauthenticated PHP Object Injection. Without a known POP chain in the plugin itself, exploitation depends on the presence of additional vulnerable plugins or themes that enable malicious object manipulation. The vulnerability affects all versions up to and including 3.2.1 and carries a high CVSS score of 8.1, indicating significant confidentiality, integrity, and availability impacts.

Successful exploitation can lead to arbitrary file deletion, disclosure of sensitive information, or remote code execution if a suitable POP chain is present in the environment. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or restricting access to the affected functionality. Monitor vendor channels for updates and apply patches promptly once released.