CVE-2024-29136: Themefic Tourfic Deserialization Vulnerability

CVE-2024-29136 Overview

CVE-2024-29136 is a PHP Object Injection vulnerability in the Themefic Tourfic plugin for WordPress. The flaw stems from deserialization of untrusted data ([CWE-502]) and affects all versions up to and including 2.11.17. An authenticated attacker with low privileges can submit crafted serialized input over the network to trigger unsafe object instantiation. Successful exploitation can lead to remote code execution, data tampering, or full site compromise when a suitable POP (property-oriented programming) chain is present in loaded plugins or themes.

Critical Impact
Authenticated attackers can inject arbitrary PHP objects, potentially achieving remote code execution and full compromise of the WordPress host.

Affected Products

Themefic Tourfic WordPress plugin, versions n/a through 2.11.17
WordPress installations with the Tourfic booking plugin enabled
Sites with authenticated (low-privilege) user access enabled

Discovery Timeline

2024-03-19 - CVE-2024-29136 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29136

Vulnerability Analysis

The Tourfic plugin passes attacker-controllable input into a PHP deserialization routine without validating or restricting the object types produced. When unserialize() processes hostile input, PHP instantiates arbitrary classes and invokes magic methods such as __wakeup(), __destruct(), or __toString(). Attackers chain these methods through gadgets available in the WordPress core, other plugins, or bundled libraries to reach dangerous sinks like file writes, SQL execution, or command execution.

The vulnerability is exploitable over the network and requires only low privileges. No user interaction is needed. Impact spans confidentiality, integrity, and availability, because a successful PHP Object Injection typically yields the same execution context as the web server process running WordPress.

Root Cause

The root cause is unsafe use of unserialize() on data influenced by an authenticated request. Tourfic accepts serialized payloads through plugin request handlers and reconstitutes PHP objects without an allowlist. PHP treats serialized strings as trusted class blueprints, so any class visible to the autoloader can be built with attacker-controlled properties.

Attack Vector

An attacker authenticates to the WordPress site with any low-privilege role that can reach a vulnerable Tourfic endpoint. The attacker submits a crafted serialized payload targeting a known gadget chain within the WordPress environment. The Tourfic handler deserializes the payload, triggering the chain during object construction or destruction. Detailed exploitation notes are available in the Patchstack Plugin Vulnerability Report.

No public proof-of-concept code has been verified. The vulnerability is described in prose only, per source availability.

Detection Methods for CVE-2024-29136

Indicators of Compromise

HTTP requests to Tourfic plugin endpoints containing serialized PHP markers such as O:, a:, or s: in POST bodies or query parameters
Unexpected PHP error log entries referencing unserialize(), __wakeup, or __destruct originating from wp-content/plugins/tourfic/
New or modified PHP files under wp-content/, especially webshells written by the www-data user
Outbound network connections from the WordPress host to unfamiliar IPs immediately after Tourfic requests

Detection Strategies

Inspect web server access logs for authenticated POST requests to Tourfic endpoints containing serialized object signatures
Enable WordPress audit logging to correlate low-privilege user activity with plugin request patterns
Deploy a web application firewall rule that flags serialized PHP data in parameters bound for the Tourfic plugin
Baseline plugin file hashes and alert on drift within wp-content/plugins/tourfic/

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized SIEM with retention sufficient for incident review
Alert on anomalous process spawns from PHP workers, such as sh, bash, curl, or wget
Track outbound egress from the web tier and flag connections to non-approved destinations

How to Mitigate CVE-2024-29136

Immediate Actions Required

Update the Themefic Tourfic plugin to a version later than 2.11.17 as soon as a fixed release is available from the vendor
Restrict registration and lower-privilege role capabilities on public WordPress sites until patched
Review WordPress user accounts and revoke access for unknown or unused low-privilege users
Audit wp-content/ for unauthorized file modifications since the plugin was installed

Patch Information

Refer to the Patchstack Vulnerability Database Entry for the latest fix status. Apply the vendor-supplied Tourfic update, then flush WordPress caches and validate site functionality after upgrade.

Workarounds

Disable and remove the Tourfic plugin if a patched version is not yet deployable in your environment
Add WAF rules to block requests containing serialized PHP object signatures targeting Tourfic paths
Enforce least privilege on WordPress roles so untrusted users cannot reach Tourfic endpoints
Isolate the WordPress host with strict egress filtering to limit post-exploitation impact

bash

# Configuration example: temporarily disable the Tourfic plugin via WP-CLI
wp plugin deactivate tourfic
wp plugin delete tourfic