Vulnerability · Published Feb 12, 2024 · Assigned by Patchstack

CVE-2024-24796WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection

High 8.2

In plain English

A high-severity unsafe deserialization in Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin from MagePeople Team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: from n/a through 4.1.1.

Affected products (as reported)

Vendor	Product	Versions
MagePeople Team	Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin	n/a – through 4.1.1

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-wpevently-plugin-4-1-1-php-object-injection-vulnerability?_s_id=cve vdb-entry