CVE-2024-10936
Published: 21 January 2025
Summary
CVE-2024-10936 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Instawp String Locator. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The String Locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 2.6.6. The flaw stems from unsafe deserialization of untrusted input inside the recursive_unserialize_replace function, which is reachable through the plugin’s search-and-replace feature and is tracked as CWE-502. No POP chain exists in the plugin itself, but the presence of an additional vulnerable plugin or theme on the same site can turn the injected object into a usable gadget.
An unauthenticated attacker can supply a serialized payload that is processed only when an administrator triggers a search-and-replace operation. Successful exploitation can result in arbitrary file deletion, disclosure of sensitive data, or remote code execution depending on the gadgets supplied by other installed components. The vulnerability carries a CVSS 3.1 score of 8.8.
Public references include the plugin’s source repository and a changeset that addresses the issue, indicating that an updated version has been published through the WordPress plugin directory. Site administrators should apply the available patch and restrict search-and-replace privileges to trusted users.
The associated EPSS score rose from lower values after disclosure to a peak of 0.2915 on 2026-01-13 before receding to the current 0.1646, indicating a period of increased exploitation interest that later subsided.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33596
Vulnerability details
The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP…
more
Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must perform a search and replace action to trigger the exploit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection in public-facing WordPress plugin directly enables remote exploitation of the web application for code execution or data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely patching of the deserialization flaw in the String Locator plugin's recursive_unserialize_replace function.
Prevents PHP object injection by enforcing validation of untrusted inputs prior to deserialization, blocking malicious serialized objects.
Detects the PHP object injection vulnerability in the WordPress plugin through periodic vulnerability scanning.