CVE-2024-4838: ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection
The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settingsencoded' attribute of the 'smilemodal' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4838?
CVE-2024-4838 is considered a critical vulnerability due to its potential for PHP Object Injection and the impact it can have on site security.
How do I fix CVE-2024-4838?
To fix CVE-2024-4838, update the ConvertPlus plugin to version 3.5.27 or later, which addresses this vulnerability.
Who is affected by CVE-2024-4838?
CVE-2024-4838 affects all versions of the ConvertPlus plugin for WordPress up to and including version 3.5.26.
Can CVE-2024-4838 be exploited remotely?
Yes, CVE-2024-4838 can be exploited remotely by authenticated attackers with access to the affected WordPress site.
What is PHP Object Injection in the context of CVE-2024-4838?
PHP Object Injection in CVE-2024-4838 refers to the ability to inject and execute malicious PHP objects through the deserialization of untrusted input.