Vulnerability Overview

• Plugin/Theme Name: MultiPurpose
• Affected versions: 1.2.0 and below
• Vulnerability Type: Authenticated (Contributor+) PHP Object Injection
• CVE ID: CVE-2024-7486
• Severity: High
• Official page URL: unknown

Vulnerability Description

We would like to inform you about a vulnerability in the “MultiPurpose” WordPress theme. This vulnerability exists in MultiPurpose themes below version 1.2.0 and is of the type Authenticated (Contributor+) PHP Object Injection. Specifically, authenticated users (those with Contributor or higher privileges) will be able to inject PHP objects through specific input. This may allow an attacker to execute arbitrary code or perform malicious operations on the entire system. The impact is widespread and is considered a very serious vulnerability because of the risk of losing complete control of the site.

Vulnerability Background

This vulnerability is due to a technical problem in PHP called object injection. PHP object injection is caused by improper handling of serialized data. Historically, similar vulnerabilities have been found in other CMSs and web applications and have received attention due to the magnitude of their impact. Especially since WordPress is widely used, many sites could be affected if this type of vulnerability is discovered.

Measures and Impacts

As a specific countermeasure against this vulnerability, it is recommended that the theme version be updated to the latest version. However, at this time, information on the version that fixes the vulnerability has not been provided, so you will need to wait for official update information. It is also important for site administrators to restrict access to users with rights beyond Contributor and to ensure that only trusted users have these rights. Failure to take countermeasures increases the risk that the site will be hijacked by an attacker, which could have serious consequences, including data leakage, tampering, and service outages.

Explanation of technical terms

• PHP Object Injection: PHP Object Injection is an attack technique that injects arbitrary PHP objects by improperly processing serialized data to execute malicious code.
• CVSS: stands for Common Vulnerability Scoring System, a standard scoring system for assessing the severity of vulnerabilities.
• CVE: stands for Common Vulnerabilities and Exposures, a system for assigning unique identifiers to publicly disclosed vulnerabilities.
• Contributor: A WordPress user permission that allows you to create posts, but not to publish them.

source of information