CVE-2024-13556
Published: 18 February 2025
Summary
CVE-2024-13556 is a high-severity Missing Authorization (CWE-862) vulnerability in Wecantrack Affiliate Links. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13556 is a PHP Object Injection vulnerability affecting the Affiliate Links: WordPress Plugin for Link Cloaking and Link Management in all versions up to and including 3.0.1. The issue arises from deserialization of untrusted input via a file export feature, enabling attackers to inject a PHP Object. It is associated with CWE-862 (Missing Authorization) and CWE-502 (Deserialization of Untrusted Data), with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability over the network with high attack complexity and no user interaction required. While the injection itself is possible, the vulnerable plugin contains no known Property-Oriented Programming (POP) chain, limiting impact unless another plugin or theme on the site provides one. In such cases, exploitation could allow arbitrary file deletion, sensitive data retrieval, or code execution, depending on the available POP chain.
Mitigation details are available in advisories from Wordfence and the WordPress plugin trac repository, including changeset 3238736 for the affiliate-links plugin, which addresses the deserialization issue. Security practitioners should update the plugin beyond version 3.0.1 and review co-installed plugins or themes for potential POP chains.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4831
Vulnerability details
The Affiliate Links: WordPress Plugin for Link Cloaking and Link Management plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.1 via deserialization of untrusted input from an file export. This makes it…
more
possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of unauthenticated deserialization flaw in public-facing WordPress plugin, enabling code execution or data impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of flaws like the PHP object deserialization vulnerability in the Affiliate Links plugin via timely patching.
Mandates validation of untrusted inputs prior to deserialization, directly preventing PHP object injection via the file export feature.
Enables vulnerability scanning to identify PHP object injection flaws in WordPress plugins like Affiliate Links before exploitation.