CVE-2024-2006

Summary

CVE-2024-2006 is a vulnerability affecting the Post Grid, Slider & Carousel Ultimate plugin for WordPress. This issue allows authenticated attackers with contributor-level access or higher to inject PHP Objects via deserialization of untrusted input in the outpost_shortcode_metabox_markup function. If a POP chain exists with an additional plugin or theme, this vulnerability could be exploited to delete files arbitrarily, retrieve sensitive data, or execute malicious code. All versions up to and including 1.6.7 are impacted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.