CVE-2024-1772: Play.ht WordPress Plugin RCE Vulnerability

CVE-2024-1772 Overview

CVE-2024-1772 is a PHP Object Injection vulnerability in the Play.ht WordPress plugin, which converts blog posts to text-to-speech audio. All versions up to and including 3.6.4 are affected. The flaw resides in the deserialization of untrusted input from the play_podcast_data post meta field. Authenticated attackers with contributor-level access or higher can inject arbitrary PHP objects. While the plugin itself contains no known Property-Oriented Programming (POP) chain, any additional plugin or theme on the target site can supply one, enabling arbitrary file deletion, sensitive data disclosure, or code execution.

Critical Impact
Contributor-level accounts can inject PHP objects that, when paired with a POP chain from another installed component, escalate to remote code execution on the WordPress host.

Affected Products

Hammadh Play.ht plugin for WordPress, versions * through 3.6.4
WordPress sites permitting contributor-level registration or higher
Sites running the Play.ht plugin alongside other plugins or themes exposing usable POP chains

Discovery Timeline

2024-03-13 - CVE-2024-1772 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1772

Vulnerability Analysis

The vulnerability is an Insecure Deserialization flaw classified under [CWE-502]. The Play.ht plugin reads the play_podcast_data post meta value and passes it to PHP's unserialize() function without validating the source or contents. Because post meta on WordPress can be written by any user role capable of editing posts, including contributors, an attacker with a low-privilege authenticated account can supply serialized PHP objects.

When unserialize() reconstructs those objects, PHP automatically invokes magic methods such as __wakeup() and __destruct() on the resulting class instances. If a class loaded elsewhere in the WordPress runtime defines these magic methods in a way that touches file operations, database queries, or reflection, the attacker can chain them into a POP gadget. The Play.ht code itself does not ship such a chain, but WordPress installations typically load dozens of classes from the core, plugins, and themes, providing a broad gadget surface.

Root Cause

The root cause is direct deserialization of user-controllable post meta in the plugin's AJAX handler. See the vulnerable call site referenced in the WordPress AJAX Handler Code. The handler trusts stored meta values without applying wp_unslash() combined with a safe parser such as json_decode(), and without restricting the meta key to serialized structures the plugin controls.

Attack Vector

An attacker authenticates as a contributor, editor, author, or administrator. The attacker creates or edits a post and sets the play_podcast_data post meta to a crafted serialized PHP object payload. When the plugin subsequently reads that meta via its AJAX handler, PHP deserializes the payload and instantiates the attacker-chosen class. If a suitable POP chain exists on the host, the resulting magic method invocations can delete files, exfiltrate data, or execute arbitrary code. Full technical context is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-1772

Indicators of Compromise

Post meta entries with key play_podcast_data containing serialized PHP data starting with O:, a:, or s: that do not match the plugin's expected structure.
Unexpected file deletions, writes to wp-content/uploads, or new PHP files under plugin or theme directories following contributor post edits.
AJAX requests to Play.ht handlers originating from contributor or author accounts that immediately precede errors in debug.log referencing unserialize() or magic method exceptions.

Detection Strategies

Inspect the wp_postmeta table for play_podcast_data values and flag any content matching PHP serialized object patterns instead of expected plugin data.
Enable WordPress debug logging and alert on PHP notices tied to __wakeup, __destruct, or unserialize on posts edited by non-administrator roles.
Correlate low-privilege user post edits with subsequent filesystem or outbound network anomalies on the web host.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized SIEM or data lake for behavioral correlation across authentication, editing, and runtime events.
Monitor endpoint telemetry on the web server for unexpected child processes spawned from php-fpm or the web server user.
Track new or modified files under wp-content/ and alert on writes that do not correspond to legitimate update activity.

How to Mitigate CVE-2024-1772

Immediate Actions Required

Update the Play.ht plugin to a version later than 3.6.4 as soon as a fixed release is available from the vendor.
Audit WordPress user accounts and remove or downgrade unnecessary contributor, author, and editor accounts.
Review the wp_postmeta table for suspicious play_podcast_data entries and remove any that contain serialized objects.

Patch Information

No vendor advisory URL is currently published in the enriched data. Site owners should consult the Wordfence Vulnerability Report and the WordPress plugin repository for the latest fixed release. Until a patched version is confirmed installed, treat any site running Play.ht 3.6.4 or earlier as vulnerable.

Workarounds

Deactivate and remove the Play.ht plugin if a patched version is not yet available.
Restrict contributor and author registration and require administrator approval for role changes.
Deploy a Web Application Firewall (WAF) rule to block requests containing serialized PHP object patterns (O: followed by a class name) in post meta parameters.
Harden PHP by keeping runtime up to date and, where feasible, replacing unserialize() usage with allow-listed classes via the allowed_classes option in custom code audits.

bash

# Identify suspicious serialized objects stored via the vulnerable meta key
wp db query "SELECT post_id, LEFT(meta_value, 80) AS preview \
  FROM wp_postmeta \
  WHERE meta_key = 'play_podcast_data' \
  AND meta_value LIKE 'O:%';"

# Disable the plugin site-wide until patched
wp plugin deactivate play-ht