Deserialization of Untrusted Data Vulnerability Affects ERE Recently Viewed - Essential Real Estate Add-On
CVE-2024-24797

9.8CRITICAL

Key Information:

Vendor
WordPress
Status
ERE Recently Viewed – Essential Real Estate Add-On
Vendor
CVE Published:
12 February 2024

Summary

A vulnerability exists in the G5Theme ERE Recently Viewed – Essential Real Estate Add-On that allows unauthenticated users to exploit a deserialization of untrusted data flaw. This vulnerability can enable attackers to manipulate serialized data to potentially execute arbitrary code on the server. The affected version ranges from n/a up to and including 1.3, making it crucial for users of this add-on to ensure their installations are updated or seek remediation strategies. Addressing this issue is essential for maintaining the integrity and security of WordPress sites utilizing this plugin.

Affected Version(s)

ERE Recently Viewed – Essential Real Estate Add-On <= 1.3

References

https://patchstack.com/database/vulnerability/ere-recentl...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yudistira Arya (Patchstack Alliance)
.