CVE-2024-13777
Published: 05 March 2025
Summary
CVE-2024-13777 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Digitalzoomstudio Zoomsounds. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Deeper analysis
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection, tracked as CWE-502, in all versions up to and including 6.91. The issue stems from deserialization of untrusted input via the 'margs' parameter, enabling attackers to inject a PHP Object. This flaw carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-05.
Unauthenticated attackers can exploit the vulnerability remotely by supplying malicious serialized data through the 'margs' parameter. While object injection is possible, no known Property-Oriented Programming (POP) chain exists within the vulnerable plugin itself, rendering it ineffective in isolation. Impact only materializes if another plugin or theme on the target WordPress site provides a POP chain, potentially allowing arbitrary file deletion, sensitive data retrieval, or arbitrary code execution depending on the chain's capabilities.
Advisories including the Wordfence threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec4633a-0742-4646-accd-cc0b9e01302a?source=cve) and the plugin's Codecanyon page (https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433) provide further details on the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53991
Vulnerability details
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for…
more
unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated PHP object injection in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications (T1190). No other techniques map directly as impacts are conditional on external POP chains and not guaranteed by this vuln alone.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the PHP object injection vulnerability by applying patches or updates to the ZoomSounds plugin that fix unsafe deserialization of the 'margs' parameter.
Validates untrusted inputs such as the 'margs' parameter to reject malicious serialized data before deserialization, preventing PHP object injection.
Prohibits installation of unapproved user-installed software like the vulnerable ZoomSounds WordPress plugin, avoiding exposure to the deserialization flaw.