Cyber Posture

CVE-2024-56291

HighRCE

Published: 07 January 2025

Published
07 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0064 70.8th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-56291 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates CVE-2024-56291 by identifying, reporting, and correcting the deserialization flaw in the PlainInventory z-inventory-manager plugin through patching or removal.

prevent

Prevents object injection exploitation by validating and sanitizing untrusted data inputs before deserialization processing in the vulnerable WordPress plugin.

detect

Identifies the deserialization vulnerability in the PlainInventory plugin via vulnerability scanning, enabling prioritization and remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct unauthenticated remote exploitation of public-facing WordPress plugin via deserialization/object injection (CWE-502).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.

Deeper analysisAI

CVE-2024-56291 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the plainware PlainInventory z-inventory-manager WordPress plugin, enabling Object Injection. The issue affects all versions of PlainInventory from n/a through 3.1.6 and was published on 2025-01-07.

Attackers can exploit this vulnerability remotely over the network (AV:N) with no required privileges (PR:N) or user interaction (UI:N), though it involves high attack complexity (AC:H). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 base score of 8.1 and unchanged scope (S:U).

The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/z-inventory-manager/vulnerability/wordpress-plaininventory-inventory-management-plugin-plugin-3-1-6-php-object-injection-vulnerability?_s_id=cve.

Details

CWE(s)

CVEs Like This One

CVE-2025-67617Shared CWE-502
CVE-2026-2020Shared CWE-502
CVE-2025-49386Shared CWE-502
CVE-2026-23549Shared CWE-502
CVE-2026-27971Shared CWE-502
CVE-2025-59287Shared CWE-502
CVE-2026-27303Shared CWE-502
CVE-2026-27417Shared CWE-502
CVE-2024-10942Shared CWE-502
CVE-2025-60214Shared CWE-502

References