PHP Object Injection Vulnerability in Grid Gallery Plugin for WordPress by WordPress

CVE-2024-1897

Summary

The Grid Gallery – Photo Image Grid Gallery plugin for WordPress is susceptible to a PHP Object Injection vulnerability across all versions up to and including 1.4.3. This vulnerability arises from the deserialization of untrusted input through the awl_gg_settings_ meta value via shortcode, allowing authenticated attackers with contributor level access or higher to inject malicious PHP objects. The absence of a Property-Oriented Programming (POP) chain within the vulnerable plugin itself does not eliminate risk; if a POP chain exists through an auxiliary plugin or theme installed on the target WordPress site, it could potentially allow attackers to delete arbitrary files, access sensitive information, or execute unauthorized code.

References