CVE-2024-13787Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'veda_backup_and_restore_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2024-13787/

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
CVE-2024-13787 - Critical Insecure Deserialization in Veda WordPress theme. CVSS 9.8. Authenticated attackers can inject PHP objects. Unpatched. Disable theme or use firewall. #CVE #WordPress #InfoSec #infoSecurity #CVEAlert #POC MORE: https://www.valtersit.com/cve/CVE-2024-13787/ for experts
Post summary
The announcement discloses a critical insecure deserialization flaw in the Veda WordPress theme, providing CVSS, technical details, and mitigation steps, and references a PoC for experts.
0000072
904 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
CVE-2024-13787 - Critical Insecure Deserialization in Veda WordPress theme. CVSS 9.8. Authenticated attackers can inject PHP objects. Unpatched. Disable theme or use firewall. #CVE #WordPress #infosec #CVEAlert #POC #CyberSecurity HUB: https://www.valtersit.com/cve/CVE-2024-13787/
Post summary
The post announces CVE‑2024‑13787, gives critical vulnerability details and a workaround, and hints at a PoC link but does not provide exploit code or evidence of active exploitation.
0000067
904 followersView on X

Explore more

Back to dashboard