CVE-2024-13833: Album Gallery WordPress Plugin RCE Flaw

CVE-2024-13833 Overview

CVE-2024-13833 affects the Album Gallery – WordPress Gallery plugin for WordPress in all versions up to and including 1.6.3. The vulnerability allows PHP Object Injection through unsafe deserialization of untrusted input from gallery meta. Authenticated attackers with Editor-level access or higher can inject arbitrary PHP objects into the application.

The plugin itself does not contain a Property-Oriented Programming (POP) chain. Exploitation impact depends on POP chains present in other installed plugins or themes. When a suitable POP chain exists, attackers can delete arbitrary files, exfiltrate sensitive data, or execute arbitrary code on the target site.

Critical Impact
Authenticated Editor-level users can inject PHP objects that, combined with a POP chain from another plugin or theme, enable arbitrary file deletion, data disclosure, or remote code execution.

Affected Products

Album Gallery – WordPress Gallery plugin for WordPress
All versions up to and including 1.6.3
WordPress sites where any installed plugin or theme provides a usable POP chain

Discovery Timeline

2025-03-01 - CVE-2024-13833 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13833

Vulnerability Analysis

The flaw is a PHP Object Injection issue classified under [CWE-502: Deserialization of Untrusted Data]. The plugin passes attacker-controlled gallery meta values into PHP's unserialize() function without validating the source or structure of that data. When PHP deserializes attacker-supplied serialized objects, it instantiates arbitrary classes and triggers magic methods such as __wakeup(), __destruct(), and __toString().

The Album Gallery plugin does not ship a POP chain of its own. Attackers therefore need a gadget class supplied by another plugin, theme, or third-party library present on the target WordPress installation. When such a gadget exists, adversaries can chain method invocations to reach dangerous sinks including file_put_contents, unlink, eval, or SQL functions.

Root Cause

The root cause is unsafe deserialization of gallery metadata that originates from authenticated user input. The plugin trusts serialized strings stored in or retrieved from gallery meta and passes them to unserialize() without a class allowlist or use of json_decode alternatives. See the WordPress Plugin Changeset for the corrective code changes.

Attack Vector

The attack is network-based and requires authentication as an Editor or higher. An attacker crafts a serialized PHP object string referencing a class exposed by another installed component. The attacker submits this payload through a plugin feature that writes to gallery meta. When the plugin later reads and deserializes the value, PHP instantiates the malicious object and executes gadget logic. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13833

Indicators of Compromise

Serialized PHP object strings beginning with O: or a: in gallery meta database entries
Unexpected file creations, deletions, or modifications under wp-content/ following Editor account activity
New or modified PHP files with recent timestamps that do not match plugin update events
Outbound network connections initiated by the PHP-FPM or Apache worker processes to unknown hosts

Detection Strategies

Query the WordPress postmeta and options tables for entries containing serialized object markers tied to Album Gallery records
Monitor web access logs for POST requests from Editor accounts to Album Gallery administrative endpoints
Alert on invocations of unserialize() in application-level tracing where inputs contain class definitions from third-party plugins

Monitoring Recommendations

Audit Editor and Administrator account creation, permission changes, and login sources on any WordPress site running Album Gallery
Track filesystem changes within the WordPress document root using integrity monitoring
Retain web server and PHP error logs for correlation with unusual object deserialization errors

How to Mitigate CVE-2024-13833

Immediate Actions Required

Update the Album Gallery plugin to a version later than 1.6.3 that contains the fix referenced in the plugin changeset
Review all Editor-level and higher accounts and remove unused or suspicious users
Inventory installed plugins and themes to identify components that could supply a POP chain
Rotate WordPress secret keys in wp-config.php if compromise is suspected

Patch Information

The vendor addressed the vulnerability in the code changes committed in WordPress Plugin Changeset 3246291. Site owners should upgrade to the latest available release of the Album Gallery plugin from the WordPress plugin repository.

Workarounds

Deactivate and remove the Album Gallery plugin until the patched version is deployed
Restrict Editor-level access to trusted staff only and enforce multi-factor authentication
Deploy a web application firewall rule to block serialized PHP object payloads in gallery meta parameters
Remove unused plugins and themes to reduce the pool of available POP chain gadgets

bash

# Configuration example: locate serialized objects in WordPress postmeta
wp db query "SELECT post_id, meta_key, meta_value FROM wp_postmeta \
  WHERE meta_value LIKE 'O:%' OR meta_value LIKE 'a:%:{s:%';"

# Force an update of the Album Gallery plugin via WP-CLI
wp plugin update new-album-gallery