Vimeography Plugin Vulnerable to PHP Object Injection

CVE-2024-0825

What is CVE-2024-0825?

The Vimeography: Vimeo Video Gallery WordPress Plugin is susceptible to a PHP Object Injection flaw due to untrusted input deserialization within the duplicate_gallery function. This vulnerability affects all versions up to and including 2.3.2, allowing authenticated attackers with contributor privileges or higher to potentially manipulate PHP Objects. Although a Proof of Concept (POP) chain is absent from the vulnerable plugin, if additional plugins or themes that facilitate this vulnerability are present in the WordPress environment, attackers could exploit it to delete files, access sensitive information, or execute arbitrary code.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References