CVE-2024-13906

HighRCE

Published: 07 March 2025

Published

07 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0034 56.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13906 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-13906 is a PHP Object Injection vulnerability (CWE-502) affecting the Gallery by BestWebSoft WordPress plugin in all versions up to and including 4.7.3. The issue arises from deserialization of untrusted input in the 'import_gallery_from_csv' function, enabling authenticated attackers with Administrator-level access or higher to inject a PHP Object. The CVSS v3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H).

Attackers must have Administrator privileges on the target WordPress site to exploit this via the CSV import feature. While the vulnerability allows object injection, no known Property-Oriented Programming (POP) chain exists within the plugin itself, rendering it ineffective in isolation. Impact depends on the presence of a POP chain from another installed plugin or theme, potentially enabling arbitrary file deletion, sensitive data retrieval, or code execution based on the chain's capabilities.

Advisories from Wordfence detail the vulnerability and reference a patch in WordPress plugin changeset 3249573, which addresses the deserialization issue. The vulnerable code is visible in the plugin source at line 292 of gallery-plugin.php in version 4.7.3. Security practitioners should update to a patched version of the plugin via the WordPress repository to mitigate the risk.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-54194

Vulnerability details

The Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.7.3 via deserialization of untrusted input in the 'import_gallery_from_csv' function. This makes…

it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The CVE describes a deserialization vulnerability in a public-facing WordPress plugin that can be directly exploited via the web application interface (CSV import function) by an authenticated admin to achieve object injection and potential code execution or data impacts.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0