WordPress Plugin Vulnerabilities

ERE Recently Viewed < 2.0 - Unauthenticated PHP Object Injection

Description

The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Affects Plugins

Plugin icon
ere-recently-viewed
Fixed in 2.0

References

CVE
CVE-2024-24797
URL
https://patchstack.com/database/vulnerability/ere-recently-viewed/wordpress-ere-recently-viewed-plugin-1-3-unauthenticated-php-object-injection-vulnerability

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Yudistira Arya
Verified
No
WPVDB ID
ce587eb3-6bd2-47a7-8873-46fc0cf7b08a

Timeline

Publicly Published
2024-01-31 (about 2 years ago)
Added
2024-02-05 (about 2 years ago)
Last Updated
2024-02-26 (about 2 years ago)

Other

Published
Title
Published
2020-11-05
Title
Welcart e-Commerce < 1.9.36 - Authenticated PHP Object Injection
Published
2024-11-18
Title
Xpresslane Fast Checkout <= 1.0.0 - Unauthenticated PHP Object Injection
Published
2025-10-11
Title
Togo < 1.0.4 - Authenticated (Subscriber+) PHP Object Injection
Published
2025-02-22
Title
Flexmls® IDX < 3.14.28 - Unauthenticated PHP Object Injection
Published
2025-04-21
Title
WP FoodBakery <= 3.3 - Unauthenticated PHP Object Injection