PHP Object Injection Vulnerability in Album Gallery Plugin by WordPress

CVE-2024-13833

Summary

The Album Gallery plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to the deserialization of untrusted input from gallery metadata. This vulnerability affects all versions up to and including 1.6.3 and can be exploited by authenticated users with Editor-level access or higher. Without a present PHP Object Pollution (POP) chain in other plugins or themes, the attack is limited. However, if such a chain exists, attackers could potentially delete files, access sensitive information, or execute unauthorized code, posing significant risks to the integrity and security of the affected WordPress installations.

References