PT-2024-38753 · Php+2 · Php+2

István Márton

·

Published

2024-08-30

·

Updated

2026-04-08

·

CVE-2024-8016

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: The Events Calendar Pro plugin for WordPress versions up to, and including, 7.0.2
Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the filters parameter in widgets. This allows authenticated attackers with administrator-level access and above to inject a PHP Object, and the presence of a POP chain enables remote code execution. In certain configurations, especially when installed with Elementor, users with contributor-level access and above can also exploit this issue.
Recommendations: For versions up to, and including, 7.0.2, update to a version later than 7.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the filters parameter in widgets to minimize the risk of exploitation. Restricting administrator-level and contributor-level access can also help mitigate the risk until a patch is applied.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-8016

Affected Products

Elementor
Php
The Events Calendar