CVE-2024-54273: Mail Picker Object Injection Vulnerability

CVE-2024-54273 Overview

CVE-2024-54273 is a PHP Object Injection vulnerability in the PickPlugins Mail Picker plugin for WordPress. The flaw stems from insecure deserialization of untrusted data [CWE-502] and affects all versions of Mail Picker up to and including 1.0.14. Unauthenticated attackers can trigger deserialization of attacker-controlled input, leading to object injection and potential remote code execution when exploitable PHP gadget chains are present in the application or other installed plugins. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction.

Critical Impact

Successful exploitation enables unauthenticated attackers to inject PHP objects, potentially achieving remote code execution, arbitrary file operations, and full compromise of the WordPress site.

Affected Products

• PickPlugins Mail Picker plugin for WordPress
• All versions from initial release through 1.0.14
• WordPress sites with the mail-picker plugin installed and active

Discovery Timeline

• 2024-12-13 - CVE-2024-54273 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54273

Vulnerability Analysis

The Mail Picker plugin passes attacker-controlled data to a PHP deserialization function without validation. PHP's unserialize() reconstructs objects from serialized strings and automatically invokes magic methods such as __wakeup(), __destruct(), and __toString(). When attacker-supplied serialized payloads are deserialized, these magic methods execute on attacker-controlled objects.

An attacker can craft a serialized payload that instantiates classes already loaded in the WordPress environment. By chaining magic method invocations across these classes (a POP chain), the attacker can pivot from object injection to arbitrary file writes, SQL execution, or remote code execution. WordPress core and popular plugins are known to contain usable gadget chains, which increases the realistic impact of this issue.

Root Cause

The root cause is the use of unserialize() on untrusted input within the mail-picker plugin. The plugin accepts serialized data from a request context and reconstructs PHP objects without integrity checks, type restrictions, or safer alternatives such as json_decode(). Mapping to [CWE-502] (Deserialization of Untrusted Data), the implementation trusts the structure and class names contained in user-supplied data.

Attack Vector

Exploitation occurs over the network against any reachable WordPress endpoint exposed by the vulnerable plugin. No authentication or user interaction is required. An attacker sends a request containing a crafted serialized PHP payload to the vulnerable handler. The plugin deserializes the payload, instantiating attacker-chosen classes and triggering their magic methods. Depending on available gadgets, the attacker can read or write files, execute database queries, or execute arbitrary PHP code under the web server account. See the Patchstack Vulnerability Report for technical references.

Detection Methods for CVE-2024-54273

Indicators of Compromise

• HTTP requests to mail-picker plugin endpoints containing serialized PHP markers such as O:, a:, or s: in parameters or cookies
• Unexpected PHP files written under wp-content/uploads/ or plugin directories following requests to the Mail Picker plugin
• New or modified WordPress administrator accounts and unexpected entries in wp_options or wp_users tables
• Outbound network connections from the web server process to unfamiliar hosts shortly after requests targeting mail-picker

Detection Strategies

• Inspect web server and WordPress access logs for requests to mail-picker plugin paths containing serialized object patterns in POST bodies, query strings, or cookies
• Deploy web application firewall rules that block payloads matching serialized PHP object syntax aimed at the plugin endpoints
• Monitor the WordPress filesystem for integrity changes, particularly under wp-content/plugins/mail-picker/ and wp-content/uploads/
• Correlate plugin requests with child process creation from the PHP-FPM or web server process to identify command execution

Monitoring Recommendations

• Enable verbose logging for the mail-picker plugin and forward web server logs to a centralized analytics platform
• Alert on PHP error log entries referencing unserialize(), __wakeup, or class instantiation failures originating from plugin code
• Track sudden spikes in POST requests to plugin endpoints from single source IP addresses or distributed scanners

How to Mitigate CVE-2024-54273

Immediate Actions Required

• Identify all WordPress sites running the PickPlugins Mail Picker plugin at version 1.0.14 or earlier
• Deactivate and remove the mail-picker plugin until a patched version is confirmed installed
• Restrict access to WordPress administrative and plugin endpoints using IP allowlists or authentication gateways where feasible
• Review web server and database logs for signs of exploitation predating mitigation

Patch Information

At the time of the NVD entry, the advisory lists affected versions through 1.0.14 with no fixed version identified. Site operators should consult the Patchstack Vulnerability Report for updated patch availability and apply any vendor-released fix immediately. If no patched release exists, removal of the plugin is the recommended path.

Workarounds

• Uninstall the Mail Picker plugin entirely if a patched version is not available
• Deploy web application firewall rules that block serialized PHP payload patterns (O:\d+:, a:\d+:) on requests targeting plugin endpoints
• Apply virtual patching at the reverse proxy or CDN layer to reject requests containing serialized objects in parameters
• Audit installed plugins and themes to reduce the availability of gadget chains exploitable through object injection

# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate mail-picker
wp plugin uninstall mail-picker

# Example ModSecurity rule to block serialized PHP payloads to plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/mail-picker/" \
  "chain,deny,status:403,id:1005401,msg:'Blocked potential PHP object injection (CVE-2024-54273)'"
  SecRule ARGS|REQUEST_COOKIES|REQUEST_BODY "@rx (O|a):[0-9]+:\"" "t:none"