PHP Object Injection Vulnerability in WordPress Importer Plugin

CVE-2024-13889

What is CVE-2024-13889?

The WordPress Importer plugin is vulnerable due to PHP Object Injection, allowing authenticated users with Administrator-level access to exploit deserialization in the 'maybe_unserialize' function. Although no direct PHP Object Pollution chain exists within the plugin, an attacker can leverage this vulnerability when other vulnerable plugins or themes with an existing POP chain are installed. This may lead to unauthorized actions like file deletion, sensitive data retrieval, or arbitrary code execution.

References