Vimeography Plugin Vulnerable to PHP Object Injection

CVE-2024-0825

Summary

The Vimeography: Vimeo Video Gallery WordPress Plugin is susceptible to a PHP Object Injection flaw due to untrusted input deserialization within the duplicate_gallery function. This vulnerability affects all versions up to and including 2.3.2, allowing authenticated attackers with contributor privileges or higher to potentially manipulate PHP Objects. Although a Proof of Concept (POP) chain is absent from the vulnerable plugin, if additional plugins or themes that facilitate this vulnerability are present in the WordPress environment, attackers could exploit it to delete files, access sensitive information, or execute arbitrary code.

References