PHP Object Injection Vulnerability in Gallery Plugin by BestWebSoft for WordPress

CVE-2024-13906

What is CVE-2024-13906?

The Gallery plugin by BestWebSoft for WordPress is susceptible to PHP Object Injection through the ‘import_gallery_from_csv’ functionality. This vulnerability is present in all versions up to 4.7.3 and may allow authenticated attackers with Administrator-level access to inject a PHP object via the deserialization of untrusted input. While there is no known Property-Oriented Programming (POP) chain in the affected software itself, the vulnerability's risk escalates if an additional plugin or theme with a POP chain is installed. If such a chain is present, attackers may exploit it to perform unauthorized actions, including deleting files, accessing sensitive information, or executing arbitrary code.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References