CVE-2024-1731

Summary

CVE-2024-1731 is a vulnerability affecting the Auto Refresh Single Page plugin for WordPress. The issue involves PHP Object Injection in versions up to 1.1, which can be exploited through deserialization of untrusted input from the arsp_options post meta option. This vulnerability allows authenticated attackers with contributor-level access or higher to inject a PHP Object, potentially leading to deletion of arbitrary files, retrieval of sensitive data, or execution of code. However, it's important to note that no known Pop chain is present in the vulnerable plugin, meaning an additional vulnerability would be required for more severe consequences.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.