PHP Object Injection Vulnerability in CozyStay and TinySalt for WordPress

CVE-2024-13410

What is CVE-2024-13410?

The CozyStay and TinySalt plugins for WordPress are susceptible to PHP Object Injection due to unsafe deserialization of untrusted input in the 'ajax_handler' function. This flaw allows unauthenticated attackers to potentially inject a PHP Object. While no direct impact exists without another plugin or theme that contains a PHP Object Property (POP) chain, the vulnerability could lead to severe consequences such as arbitrary file deletions, sensitive data retrieval, or remote code execution if such a chain is present on the site. Site administrators should take special care to secure their environments against this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References