PHP Object Injection Vulnerability in ZoomSounds WordPress Plugin

CVE-2024-13777

What is CVE-2024-13777?

The ZoomSounds plugin for WordPress exposes a vulnerability that allows unauthenticated attackers to exploit PHP Object Injection via deserialization of untrusted input from the 'margs' parameter. While the underlying software does not contain a known PHP Object Propagation (POP) chain, the risk escalates if additional plugins or themes with such chains are present. In such cases, attackers could potentially execute harmful actions, including file deletions, data retrieval, or arbitrary code execution, posing significant security risks to WordPress installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References