CVE-2024-52410CWE-502

WordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerability

Critical · published November 16, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

🔥 A crafty object injection vulnerability in Phoenixheart Referrer Detector could let attackers execute arbitrary code! Think of this vulnerability as a chef at a restaurant who blindly follows an order to add ingredients without checking if they’re safe — one bad item could ruin the entire dish. With untrusted data sneaking in, it’s like letting someone write their own recipe that you have to serve to your customers! The consequences could be absolutely devastating: an attacker could gain control over the server, manipulate data, or even launch further attacks on your network. Imagine an unauthorized guest taking over the kitchen and reprogramming the menu to serve something malicious!

Put simply

Think of this vulnerability as a chef at a restaurant who blindly follows an order to add ingredients without checking if they’re safe — one bad item could ruin the entire dish. With untrusted data sneaking in, it’s like letting someone write their own recipe that you have to serve to your customers! This deserialization vulnerability allows an attacker to inject untrusted objects into the application, which could lead to remote code execution. Versions from n/a through 4.2.1.0 are impacted, highlighting an urgent need for action.

What to do

The consequences could be absolutely devastating: an attacker could gain control over the server, manipulate data, or even launch further attacks on your network. Imagine an unauthorized guest taking over the kitchen and reprogramming the menu to serve something malicious! To safeguard your systems, immediately update Phoenixheart Referrer Detector to the patched version. Additionally, ensure proper validation of all incoming data before deserialization to block any nefarious inputs. You’ve got this! Follow these steps to fortify your defenses and keep your kitchen safe from unwanted ingredients! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-11-16T21:40Z
EPSS history
Timeline
  • 16 NOV 21:40Z
    WordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerability
    cvelistv5