Untrusted Input Vulnerability in Photo Video Gallery Master Plugin Allows PHP Object Injection and File Delete

CVE-2024-5724

Summary

The Photo Video Gallery Master plugin for WordPress is susceptible to a PHP Object Injection vulnerability that affects all versions up to and including 1.5.3. This vulnerability arises from the deserialization of untrusted input in the 'PVGM_all_photos_details' parameter, allowing authenticated users with Contributor-level access or higher to inject PHP objects. While there is no known PHP Object Propagation (POP) chain present in the vulnerable software itself, an existing POP chain through additional plugins or themes can lead to severe repercussions. Attackers may exploit this vulnerability to delete arbitrary files, compromise sensitive information, or execute malicious code, significantly impacting the integrity and confidentiality of the affected WordPress installation.

References