CVE-2024-7656

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrusted input in the 'devvn_ihotspot_shortcode_func' function. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-76575.4A vulnerability classified as problematic was found in Gila CMS 1.10.9. This vulnerability affects unknown code of the file /cm/update_rows/CVE-2024-76585.3A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_previewCVE-2024-76597.5A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string CVE-2024-76606.1A vulnerability has been found in SourceCodester File Manager App 1.0 and classified as problematic. Affected by this vulnerability is an unCVE-2024-76618.8A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been classified as problematic. This affects thCVE-2024-76626.5A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. This vulnerabilitCVE-2024-76635.3A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been rated as critical. This issue affects someCVE-2024-76644.3A vulnerability classified as critical has been found in SourceCodester Car Driving School Management System 1.0. Affected is an unknown funCVE-2024-76654.3A vulnerability classified as critical was found in SourceCodester Car Driving School Management System 1.0. Affected by this vulnerability CVE-2024-76665.3A vulnerability, which was classified as critical, has been found in SourceCodester Car Driving School Management System 1.0. Affected by thCVE-2024-76675.3A vulnerability, which was classified as critical, was found in SourceCodester Car Driving School Management System 1.0. This affects the fuCVE-2024-76685.3A vulnerability has been found in SourceCodester Car Driving School Management System 1.0 and classified as critical. This vulnerability aff
CVE-2024-7656: High severity, CVSS 8.8 | Vulnix