CVE-2024-56291
Published: 07 January 2025
Summary
CVE-2024-56291 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-56291 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the plainware PlainInventory z-inventory-manager WordPress plugin, enabling Object Injection. The issue affects all versions of PlainInventory from n/a through 3.1.6 and was published on 2025-01-07.
Attackers can exploit this vulnerability remotely over the network (AV:N) with no required privileges (PR:N) or user interaction (UI:N), though it involves high attack complexity (AC:H). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 base score of 8.1 and unchanged scope (S:U).
The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/z-inventory-manager/vulnerability/wordpress-plaininventory-inventory-management-plugin-plugin-3-1-6-php-object-injection-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53088
Vulnerability details
Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing WordPress plugin via deserialization/object injection (CWE-502).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2024-56291 by identifying, reporting, and correcting the deserialization flaw in the PlainInventory z-inventory-manager plugin through patching or removal.
Prevents object injection exploitation by validating and sanitizing untrusted data inputs before deserialization processing in the vulnerable WordPress plugin.
Identifies the deserialization vulnerability in the PlainInventory plugin via vulnerability scanning, enabling prioritization and remediation.