CVE-2024-13556

Summary

CVE-2024-13556 is a vulnerability affecting the Affiliate Links: WordPress Plugin for Link Cloaking and Link Management. This issue, present in all versions up to 3.0.1, allows unauthenticated attackers to inject PHP Objects through deserialization of untrusted input from an exported file. However, no known exploit chain (POP chain) exists within the plugin itself, meaning this vulnerability cannot be exploited in isolation. If a POP chain is present in an additional plugin or theme on the target system, an attacker could potentially delete files, retrieve sensitive data, or execute code.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.