CVE-2024-24926

CVE-2024-24926 Vulnerability affects the Brooklyn theme for WordPress

Description: The CVE-2024-24926 vulnerability affects the Brooklyn theme for WordPress (versions up to 4.9.7.6) and is related to deserialization of untrusted data (CWE-502). This allows an attacker to send malicious objects to the server, potentially achieving remote code execution. According to CVSS v3.1 assessment, it has a score of 7.5 (High), with a network-based attack vector, high complexity, low required privileges, and no user interaction.

Serialized object in PHP

<?php
class Malicious {
    public $cmd = 'system("whoami");';
}
echo base64_encode(serialize(new Malicious()));
?>