Vulnerability in Grid View Gallery Plugin Allows PHP Object Injection

CVE-2024-11409

Summary

The Grid View Gallery plugin for WordPress is susceptible to PHP Object Injection, which allows authenticated users with Editor-level access and higher to exploit deserialization of untrusted input from the cs_all_photos_details parameter. This vulnerability can enable attackers to inject a PHP Object, posing significant risks if an exploit chain is available through additional plugins or themes. Such exploitation could result in unauthorized file deletions, retrieval of sensitive data, or execution of malicious code.

References