CVE-2024-10936

CVE-2024-10936 is a PHP Object Injection vulnerability affecting all versions up to 2.6.6 of the String locator plugin for WordPress. This flaw allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in the 'recursive_unserialize_replace' function. The vulnerability has a CVSS score of 8.8 (HIGH) due to its network attack vector and low complexity, potentially leading to arbitrary file deletion, sensitive data retrieval, or code execution if a POP chain exists elsewhere on the system. While an administrator action is required to trigger the exploit, there is currently no known exploit code, active exploitation, or significant community discussion surrounding this CVE.