CVE-2024-4733

CVE-2024-4733 describes a PHP Object Injection vulnerability in the ShiftController Employee Shift Scheduling plugin, affecting versions up to and including 4.9.57. This flaw allows an authenticated attacker with contributor-level access or higher to inject a PHP Object through the hc3_session cookie. While the plugin itself lacks a direct POP chain, if another plugin or theme on the system provides one, it could lead to arbitrary file deletion, sensitive data retrieval, or remote code execution. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges. Its EPSS score is low, suggesting a low probability of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received no community discussion or media coverage, aligning with the typical lack of attention for most CVEs.