CVE-2024-13789

CVE-2024-13789 describes a critical PHP Object Injection vulnerability in the matiskiba ravpage WordPress plugin, affecting all versions up to and including 2.31. This flaw allows unauthenticated attackers to inject PHP Objects via the 'paramsv2' parameter due to insecure deserialization. While the plugin itself lacks a known POP chain, its exploitation could lead to severe consequences like arbitrary file deletion, sensitive data retrieval, or code execution if another plugin or theme on the system provides a suitable POP chain. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has garnered significant community discussion.