CVE-2024-1872

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of untrusted input in the button_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-18739.1parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in versionCVE-2024-18749.4In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufCVE-2024-18758.8A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown procCVE-2024-18769.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown functCVE-2024-18778.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerabilityCVE-2024-18788.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unCVE-2024-18798.8A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commaCVE-2024-18807.8An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affectiCVE-2024-18819.8AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command CVE-2024-18827.2This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code executioCVE-2024-18836.1This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crCVE-2024-18846.5This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the s