Platform
wordpress
Component
devvn-image-hotspot
Opgelost in
1.2.6
CVE-2024-7656 describes a PHP Object Injection vulnerability discovered in the Image Hotspot by DevVN WordPress plugin. This vulnerability allows authenticated attackers with Author-level access or higher to inject malicious PHP objects, potentially compromising the WordPress site. The vulnerability impacts versions of the plugin up to and including 1.2.5. A fix is available via plugin update.
The core impact of CVE-2024-7656 lies in the ability of an authenticated attacker to inject arbitrary PHP objects. While no known PHP Object Poisoning (POP) chain exists within the vulnerable plugin itself, the potential for exploitation significantly increases if other plugins or themes on the target system are susceptible to POP chains. Successful exploitation could allow an attacker to delete files, exfiltrate sensitive data stored on the WordPress site (such as user credentials, database connection strings, or configuration files), or even execute arbitrary code on the server. This could lead to complete site takeover and data breaches.
CVE-2024-7656 was publicly disclosed on August 24, 2024. Currently, no public proof-of-concept (POC) code has been released, but the vulnerability's nature and potential impact suggest it could become a target for exploitation. It is not currently listed on the CISA KEV catalog. The vulnerability requires authentication, limiting the immediate scope of potential exploitation, but the potential for privilege escalation within a WordPress environment remains a significant concern.
WordPress websites utilizing the Image Hotspot by DevVN plugin, particularly those with multiple plugins or themes installed, are at elevated risk. Shared hosting environments where multiple WordPress instances share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.
• wordpress / composer / npm:
grep -r 'devvn_ihotspot_shortcode_func' /var/www/html/wp-content/plugins/image-hotspot/• wordpress / composer / npm:
wp plugin list --status=active | grep image-hotspot• wordpress / composer / npm:
wp plugin update image-hotspotdisclosure
Exploit Status
EPSS
1.63% (82% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation for CVE-2024-7656 is to immediately update the Image Hotspot by DevVN plugin to a version that addresses the vulnerability. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider temporarily restricting access to the 'devvnihotspotshortcode_func' function or disabling the plugin entirely. While a WAF may offer some protection, it is unlikely to be effective against this type of vulnerability without specific rules tailored to PHP Object Injection. After upgrading, verify the fix by attempting to trigger the shortcode with a crafted payload designed to exploit the vulnerability – the plugin should now properly sanitize the input.
Actualice el plugin Image Hotspot by DevVN a la última versión disponible. Esto solucionará la vulnerabilidad de inyección de objetos PHP.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2024-7656 is a HIGH severity vulnerability in the Image Hotspot WordPress plugin that allows authenticated attackers to inject PHP objects, potentially leading to code execution.
You are affected if you are using Image Hotspot by DevVN plugin versions 1.2.5 or earlier. Immediately check your plugin versions and update if necessary.
Update the Image Hotspot by DevVN plugin to the latest available version. If upgrading is not possible, temporarily disable the plugin or restrict access to the vulnerable function.
While no active exploitation has been confirmed, the vulnerability's potential impact makes it a likely target for future attacks.
Refer to the DevVN website and WordPress plugin repository for the latest advisory and update information regarding CVE-2024-7656.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.