Untrusted Data Deserialization Vulnerability leading to Object Injection
CVE-2024-49624

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Advanced Advertising System
Vendor
CVE Published:
20 October 2024

What is CVE-2024-49624?

The Advanced Advertising System by Smartdevth contains a deserialization of untrusted data vulnerability that allows attackers to perform object injection. This security flaw can lead to unauthorized actions or even compromise the systems that utilize this plugin, particularly in versions from n/a up to 1.3.1. It is imperative for users of this product to implement appropriate security measures and updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

Advanced Advertising System <= 1.3.1

References

https://patchstack.com/database/vulnerability/advanced-ad...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.