CVE-2024-1895

CVE-2024-1895 is a PHP Object Injection vulnerability affecting the Event Monster – Event Management, Tickets Booking, Upcoming Event WordPress plugin, versions 1.3.4 and earlier. It allows authenticated attackers with contributor-level access or higher to inject PHP objects through deserialization of untrusted input from a custom meta value. Rated with a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and high attack complexity, as it requires a separate POP chain from another plugin or theme to achieve impacts like arbitrary file deletion, sensitive data retrieval, or code execution. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei. The vulnerability has garnered minimal community discussion and media coverage, indicating low public awareness.