CVE-2024-2025 is a high-severity vulnerability (CVSS 8.8) in the themekraft BuddyPress WooCommerce My Account Integration plugin for WordPress. It arises from unsafe deserialization of untrusted data in the get_simple_request function, enabling PHP Object Injection. Authenticated users with low privileges (subscriber and above) can exploit this to potentially perform destructive or unauthorized actions if a POP chain is present in the environment. This vulnerability is related to CWE-502 and is likely duplicated by CVE-2024-32603. No official patch or remediation details have been provided by the vendor.

Successful exploitation allows authenticated attackers with subscriber-level access to inject PHP objects, which can lead to arbitrary file deletion, sensitive data disclosure, or remote code execution if a suitable POP chain exists. This compromises confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to this plugin. Consider disabling or removing the plugin if possible to reduce risk.