PT-2025-7389 · WordPress · Ravpage

Frissi0N

·

Published

2025-02-20

·

Updated

2025-02-20

·

CVE-2024-13789

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ravpage plugin for WordPress versions up to, and including, 2.31
Description The issue concerns a PHP Object Injection vulnerability via deserialization of untrusted input from the paramsv2 parameter. This allows unauthenticated attackers to inject a PHP Object. The vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present, it may allow attackers to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code, depending on the POP chain present.
Recommendations For versions up to, and including, 2.31, consider disabling the deserialization of input from the paramsv2 parameter until a patch is available. Restrict access to the ravpage plugin to minimize the risk of exploitation. Avoid using the paramsv2 parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-13789

Affected Products

Ravpage