PHP Object Injection Vulnerability in Brooklyn Theme for WordPress

CVE-2024-13636

Summary

The Brooklyn Theme for WordPress is susceptible to PHP Object Injection through the ot_decode function, exploitable in all versions up to 4.9.9.2. This vulnerability allows authenticated attackers with Subscriber-level access and higher to inject malicious PHP Objects by deserializing untrusted input. The absence of a known PHP Object Pollution (POP) chain in the vulnerable theme implies that, without additional vulnerable plugins or themes on the WordPress site, the impact is limited. However, if a compatible POP chain exists, it may provide attackers the ability to delete arbitrary files, access sensitive information, or execute malicious code depending on the nature of the POP chain established by other installed extensions.

References