CVE-2024-10079 Overview
CVE-2024-10079 affects the WP Easy Post Types plugin for WordPress in versions up to and including 1.4.4. The vulnerability stems from insecure deserialization of untrusted input passed through the text parameter in the ajax_import_content function. Authenticated attackers with subscriber-level access or above can inject a PHP object into the deserialization process. The plugin itself contains no Property-Oriented Programming (POP) chain, but a chain present in another installed plugin or theme can enable arbitrary file deletion, sensitive data retrieval, or code execution [CWE-502].
Critical Impact
Authenticated subscribers can trigger PHP Object Injection, which chains with other plugins or themes to enable file deletion, data theft, or remote code execution.
Affected Products
- Newsignature WP Easy Post Types plugin for WordPress
- All versions up to and including 1.4.4
- WordPress sites with any additional plugin or theme providing a usable POP chain
Discovery Timeline
- 2024-10-18 - CVE-2024-10079 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10079
Vulnerability Analysis
The vulnerability resides in the ajax_import_content function of the WP Easy Post Types plugin. The function accepts a text parameter from an AJAX request and passes it to a PHP deserialization routine without validation. Because deserialization instantiates PHP objects and can invoke magic methods such as __wakeup and __destruct, attacker-controlled serialized data becomes executable object state.
The plugin does not ship a POP chain of its own. However, WordPress environments commonly load dozens of plugins and themes that expose classes with dangerous magic methods. When such classes are autoloaded, a POP chain becomes reachable through the injected object graph. The impact then extends to arbitrary file deletion, sensitive data disclosure, or remote code execution.
Root Cause
The root cause is unsafe use of PHP's unserialize() on user-supplied input reaching the ajax_import_content handler. The handler enforces only a low-privilege capability check, allowing any authenticated user, including subscribers, to reach the sink. See the WordPress Custom Type Code for the affected implementation.
Attack Vector
An attacker authenticates to the target WordPress site with at least subscriber privileges. The attacker sends a crafted AJAX request to the ajax_import_content endpoint with a text parameter containing a serialized PHP object payload. Deserialization triggers the object graph, and any POP gadget loaded by another plugin or theme executes the attacker's intended action.
The vulnerability mechanism is described in prose only; no verified public exploit code is available. Additional analysis is documented in the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2024-10079
Indicators of Compromise
- POST requests to admin-ajax.php with action=ajax_import_content from low-privilege user sessions
- text parameter values beginning with PHP serialization markers such as O:, a:, or s:
- Unexpected file deletions, new PHP files in wp-content/uploads, or modified wp-config.php
- New administrator accounts or unexplained option changes in wp_options
Detection Strategies
- Inspect WordPress access logs for authenticated calls to ajax_import_content originating from subscriber, contributor, or author roles
- Deploy a web application firewall rule that blocks serialized PHP payloads in AJAX request bodies
- Compare installed plugin versions against the fixed release using automated inventory tooling
Monitoring Recommendations
- Alert on file integrity changes across wp-content/plugins and wp-content/themes
- Monitor for PHP process spawning shell utilities such as sh, bash, or curl from the web server user
- Track outbound network connections initiated by the PHP-FPM or Apache worker processes to unusual destinations
How to Mitigate CVE-2024-10079
Immediate Actions Required
- Update the WP Easy Post Types plugin to a version later than 1.4.4 as soon as a patched release is available
- Audit user registrations and disable open registration if not required for site operation
- Review installed plugins and themes for known POP gadget classes and remove unused components
Patch Information
At the time of publication, the vulnerability affects all versions up to and including 1.4.4. Administrators should consult the Wordfence Vulnerability Analysis and the WordPress.org plugin repository for the latest fixed version and apply it immediately.
Workarounds
- Deactivate and remove the WP Easy Post Types plugin until a fixed release is installed
- Restrict access to admin-ajax.php for low-privilege roles using a WAF or reverse proxy rule
- Remove or disable optional plugins and themes that expose classes with __destruct or __wakeup gadgets
- Enforce least privilege by demoting or removing unnecessary subscriber-level accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
