CVE-2024-2008

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Modal Popup Box – Popup Builder, Show Offers And News in Popup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.2 via deserialization of untrusted input in the awl_modal_popup_box_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-200809.8In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation ofCVE-2024-200816.7In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege CVE-2024-200829.8In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote code execution with no additional eCVE-2024-200839.8In venc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SystemCVE-2024-200844.4In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System CVE-2024-200854.4In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System CVE-2024-200866.7In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SystemCVE-2024-200876.7In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SystemCVE-2024-200884.4In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with SyCVE-2024-200897.5In wlan, there is a possible denial of service due to incorrect error handling. This could lead to remote denial of service with no additionCVE-2024-20097.5A vulnerability was found in Nway Pro 9. It has been rated as problematic. Affected by this issue is the function ajax_login_submit_form of CVE-2024-200906.7In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System
CVE-2024-2008: High severity, CVSS 8.8 | Vulnix