CVE-2024-24796: WpEvently Deserialization Vulnerability

CVE-2024-24796 Overview

CVE-2024-24796 is a PHP Object Injection vulnerability affecting the MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently WordPress plugin. The flaw stems from deserialization of untrusted data [CWE-502] in plugin versions up to and including 4.1.1. Authenticated attackers with low privileges can send crafted serialized payloads that trigger object instantiation within the PHP runtime. Successful exploitation can lead to remote code execution, data tampering, or full compromise of the underlying WordPress site. The vulnerability is tracked in the Patchstack database and impacts WooCommerce storefronts that rely on WpEvently for event and ticket sales.

Critical Impact
Authenticated attackers can inject malicious PHP objects to achieve code execution and compromise confidentiality, integrity, and availability of the WordPress site.

Affected Products

MagePeople Team WpEvently – Event Manager and Tickets Selling Plugin for WooCommerce, versions through 4.1.1
WordPress installations using vulnerable WpEvently releases
WooCommerce storefronts integrating WpEvently for ticket sales

Discovery Timeline

2024-02-12 - CVE-2024-24796 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24796

Vulnerability Analysis

The vulnerability is an Insecure Deserialization flaw classified under [CWE-502]. WpEvently processes serialized data received from user-controlled input without validating the class types being instantiated. When PHP's unserialize() function encounters this data, it reconstructs arbitrary PHP objects and invokes magic methods such as __wakeup() or __destruct(). Attackers who chain gadgets from loaded libraries can convert this behavior into arbitrary code execution or file operations. Because the attack requires only low-privilege authentication, any subscriber-level account or compromised customer account becomes a viable launch point.

Root Cause

The plugin invokes PHP deserialization on data controlled by authenticated users without first enforcing an allow-list of expected classes. Safer alternatives such as JSON decoding or unserialize() with an allowed_classes restriction were not applied. This design permits object injection through any code path that reaches the vulnerable sink.

Attack Vector

An authenticated attacker submits a serialized PHP payload through a plugin endpoint that accepts and deserializes user input. The payload references classes present in WordPress core, WooCommerce, or third-party plugins to build a gadget chain. Once instantiated, the chain triggers unintended actions such as file writes, SQL queries, or command execution. The attack is delivered over the network against the WordPress HTTP interface.

No verified public proof-of-concept code is available for this CVE. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2024-24796

Indicators of Compromise

Requests to WpEvently endpoints containing serialized PHP markers such as O:, a:, or s: in POST bodies or query parameters
Unexpected PHP files or webshells written under wp-content/uploads/ or plugin directories after authenticated user activity
New administrator accounts or modifications to wp_options following requests from low-privilege sessions
Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts

Detection Strategies

Inspect HTTP request bodies destined for WpEvently endpoints for PHP serialization patterns and block or alert on matches
Correlate authenticated WordPress sessions with subsequent file system changes to plugin, theme, or upload directories
Enable WordPress audit logging to capture privilege changes, plugin installations, and option updates initiated by non-administrator roles

Monitoring Recommendations

Forward web server access logs and WordPress activity logs to a centralized SIEM for correlation with process telemetry
Monitor the web server user for spawning of sh, bash, python, or curl processes, which indicate post-exploitation activity
Track integrity of core WordPress and plugin files using file integrity monitoring to detect unauthorized modifications

How to Mitigate CVE-2024-24796

Immediate Actions Required

Upgrade WpEvently to a version later than 4.1.1 that addresses the deserialization flaw per the vendor advisory
Audit WordPress user accounts and revoke any low-privilege accounts that are unnecessary or inactive
Rotate WordPress salts, administrator passwords, and API keys if exploitation is suspected
Review wp-content/uploads/ and plugin directories for unauthorized PHP files

Patch Information

MagePeople Team addresses the vulnerability in releases after 4.1.1. Consult the Patchstack Vulnerability Database Entry for the fixed version and vendor guidance. Apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Deactivate the WpEvently plugin until an update can be applied if the site does not require event or ticket functionality
Deploy a web application firewall rule to block requests containing PHP serialization patterns targeting WpEvently endpoints
Restrict registration of new WordPress accounts and enforce multi-factor authentication for all existing accounts
Run PHP with disable_functions restrictions to limit the impact of gadget chains that call system-level functions

bash

# Example WP-CLI commands to update the plugin and audit users
wp plugin update wp-eventpress
wp plugin list --status=active --format=table
wp user list --role=subscriber --fields=ID,user_login,user_registered