Unauthenticated PHP Object Injection Vulnerability in WordPress Clone Plugin

CVE-2024-10913

Summary

The WP Clone plugin for WordPress has a vulnerability that enables PHP Object Injection through deserialization of untrusted input in the 'recursive_unserialized_replace' function. This issue exists in all versions up to and including 2.4.6, allowing unauthenticated attackers to potentially inject malicious PHP Objects. While no known PHP Object Protocol (POP) chain exists within the plugin itself, the presence of additional plugins or themes may allow for significant threats, such as the ability to delete arbitrary files, obtain sensitive data, or execute arbitrary code.

References