PT-2025-14844 · WordPress · Tagdiv Composer

Michael Mazzolini · Published 2025-04-04 · Updated 2025-04-09 · CVE-2024-13645

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tagDiv Composer plugin for WordPress versions up to, and including, 5.3

Description The issue allows unauthenticated attackers to instantiate a PHP object via the module parameter. This vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present, it may allow the attacker to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code, depending on the POP chain present.

Recommendations For versions up to, and including, 5.3, consider disabling the module parameter to minimize the risk of exploitation until a patch is available. Restrict access to sensitive data and files to prevent potential damage in case a POP chain is present via another plugin or theme.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-13645

Affected Products

Tagdiv Composer

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-13645 · Security Note
• https://tagdiv.com/tagdiv-composer-page-builder-basics · Note
• https://t.me/cvedetector/22101 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4124003c-4864-48f1-acba-9a613d9c99ae?source=cve · Note
• https://t.me/cvetracker/20781 · Telegram Post
• https://twitter.com/cracbot/status/1909924355980542129 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1908111837784154145 · Twitter Post
• https://twitter.com/CveFindCom/status/1908037483645833227 · Twitter Post
• https://twitter.com/CVEnew/status/1908072012657860683 · Twitter Post
• https://t.me/cvenotify/117694 · Telegram Post