PHP Object Injection Vulnerability in CozyStay and TinySalt for WordPress
CVE-2024-13410
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 March 2025
What is CVE-2024-13410?
The CozyStay and TinySalt plugins for WordPress are susceptible to PHP Object Injection due to unsafe deserialization of untrusted input in the 'ajax_handler' function. This flaw allows unauthenticated attackers to potentially inject a PHP Object. While no direct impact exists without another plugin or theme that contains a PHP Object Property (POP) chain, the vulnerability could lead to severe consequences such as arbitrary file deletions, sensitive data retrieval, or remote code execution if such a chain is present on the site. Site administrators should take special care to secure their environments against this issue.
Affected Version(s)
CozyStay - Hotel Booking WordPress Theme * <= 1.7.0
TinySalt - Personal Food Blog WordPress Theme * <= 3.9.0