CVE-2024-1772 is a PHP Object Injection vulnerability affecting the Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio WordPress plugin, versions up to and including 3.6.4. This flaw allows authenticated attackers with contributor-level access or higher to inject PHP objects through deserialization of untrusted input. The vulnerability carries a high CVSS score of 8.8, indicating a critical risk. While no direct POP chain exists within the plugin, if another plugin or theme on the system provides one, it could lead to arbitrary file deletion, sensitive data retrieval, or remote code execution. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.6.4CPE matchmatch criteria | cpe:2.3:a:hammadh:play.ht:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.