PHP Object Injection Vulnerability in ZoomSounds WordPress Plugin

CVE-2024-13777

What is CVE-2024-13777?

The ZoomSounds plugin for WordPress exposes a vulnerability that allows unauthenticated attackers to exploit PHP Object Injection via deserialization of untrusted input from the 'margs' parameter. While the underlying software does not contain a known PHP Object Propagation (POP) chain, the risk escalates if additional plugins or themes with such chains are present. In such cases, attackers could potentially execute harmful actions, including file deletions, data retrieval, or arbitrary code execution, posing significant security risks to WordPress installations.

References