CVE-2024-13824

Summary

CVE-2024-13824 is a vulnerability in the CiyaShop Multipurpose WooCommerce Theme for WordPress. The issue lies in deserialization of untrusted input in the 'add_ciyashop_wishlist' and 'ciyashop_get_compare' functions, allowing unauthenticated attackers to inject a PHP Object. No Pop chain is present in the vulnerable software, so the impact is limited to the exploitation of this specific vulnerability. However, if a Pop chain exists in an additional plugin or theme installed on the target system, an attacker could potentially delete files, retrieve sensitive data, or execute code.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.