CVE-2024-12600 is a deserialization of untrusted data vulnerability (CWE-502) in the Custom Product Tabs Lite for WooCommerce plugin for WordPress, affecting all versions up to 1.9.0. The vulnerability arises from unsafe deserialization of the 'frs_woo_product_tabs' parameter, enabling authenticated attackers with Shop Manager or higher privileges to perform PHP Object Injection. While the plugin alone does not contain a POP chain for exploitation, the presence of additional plugins or themes with gadget chains could enable severe impacts such as arbitrary file deletion, data leakage, or remote code execution. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Shop Manager-level access or higher can inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or remote code execution if a suitable POP chain exists in the environment. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager and higher privileges to trusted users only, and monitor for suspicious activity related to the 'frs_woo_product_tabs' parameter. Review installed plugins and themes for potential POP chains that could be leveraged in exploitation.