Unauthenticated PHP Object Injection Vulnerability in WordPress Clone Plugin

CVE-2024-10913

What is CVE-2024-10913?

The WP Clone plugin for WordPress has a vulnerability that enables PHP Object Injection through deserialization of untrusted input in the 'recursive_unserialized_replace' function. This issue exists in all versions up to and including 2.4.6, allowing unauthenticated attackers to potentially inject malicious PHP Objects. While no known PHP Object Protocol (POP) chain exists within the plugin itself, the presence of additional plugins or themes may allow for significant threats, such as the ability to delete arbitrary files, obtain sensitive data, or execute arbitrary code.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References