Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection

CVE-2024-3954

What is CVE-2024-3954?

The Ditty plugin for WordPress contains a vulnerability that allows for PHP Object Injection due to improper handling of untrusted input during the addition of new content. This issue affects all versions of the plugin up to 3.1.38. Authenticated users with contributor-level access and above can exploit this flaw to inject malicious PHP objects. While there is no known primitive object propagation (POP) chain within the plugin itself, the presence of a POP chain through other installed plugins or themes could potentially enable attackers to perform destructive actions such as deleting arbitrary files, extracting sensitive data, or executing unauthorized code. Users are advised to update to the latest version of the Ditty plugin to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References