CVE-2024-54282: WP Mega Menu Object Injection Vulnerability

CVE-2024-54282 Overview

CVE-2024-54282 is a PHP Object Injection vulnerability in the Themeum WP Mega Menu (wp-megamenu) plugin for WordPress. The flaw stems from unsafe deserialization of untrusted data [CWE-502] and affects all versions up to and including 1.4.2. An authenticated attacker with high privileges can submit crafted serialized input that the plugin passes to PHP's unserialize() function. Successful exploitation triggers object injection, which can lead to arbitrary code execution, data tampering, or denial of service when suitable gadget chains exist in the WordPress environment.

Critical Impact
Object injection through unsafe deserialization can allow attackers to compromise confidentiality, integrity, and availability of affected WordPress sites running WP Mega Menu 1.4.2 or earlier.

Affected Products

Themeum WP Mega Menu (wp-megamenu) plugin for WordPress
All versions from initial release through 1.4.2
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2024-12-13 - CVE-2024-54282 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54282

Vulnerability Analysis

The vulnerability is a PHP Object Injection issue caused by deserialization of untrusted data within the WP Mega Menu plugin. When the plugin calls unserialize() on attacker-controlled input, PHP reconstructs arbitrary objects from the serialized payload. During object lifecycle events such as __wakeup() or __destruct(), magic methods execute automatically. Attackers abuse these magic methods to chain existing classes (POP chains) available in WordPress core, themes, or other installed plugins. Depending on the gadgets present, exploitation results in file writes, arbitrary code execution, or manipulation of database records.

Root Cause

The root cause is the plugin's use of PHP unserialize() on input that traverses trust boundaries without validation. Serialized PHP data is not a safe transport format for untrusted input because it embeds class names and property values that PHP instantiates automatically. The plugin fails to enforce allow-listed classes or switch to a safe format such as JSON, leaving the deserialization path exposed to object injection.

Attack Vector

Exploitation requires network access to the target WordPress site and an authenticated session with high privileges. The attacker submits a crafted serialized payload to a plugin endpoint that reaches the vulnerable deserialization routine. No user interaction is required. Impact depends on the gadget chains available in the runtime environment. Refer to the Patchstack WP Mega Menu Vulnerability advisory for additional technical context.

Detection Methods for CVE-2024-54282

Indicators of Compromise

HTTP requests to WP Mega Menu endpoints containing serialized PHP markers such as O:, a:, or s: followed by class names and property counts.
Unexpected PHP files, scheduled tasks (wp_cron entries), or modified theme/plugin files following administrator activity.
Anomalous outbound connections from the web server process (php-fpm, apache2) after plugin interaction.
Unexpected changes to WordPress options table entries or new administrator accounts.

Detection Strategies

Inspect web server and WAF logs for POST requests targeting wp-megamenu handlers with serialized PHP payloads.
Enable WordPress debug logging and audit calls to unserialize() in plugin execution paths.
Use file integrity monitoring across wp-content/plugins/wp-megamenu/ and adjacent WordPress directories.

Monitoring Recommendations

Alert on privileged user sessions that submit large or base64-encoded parameters to plugin AJAX endpoints.
Monitor for new PHP processes spawning shell commands from the web server user context.
Track administrative account creation, role changes, and plugin install events in the WordPress audit log.

How to Mitigate CVE-2024-54282

Immediate Actions Required

Update Themeum WP Mega Menu to a version later than 1.4.2 as soon as a patched release is available from the vendor.
Restrict administrative access to the WordPress backend using strong authentication and IP allow-listing.
Review site administrator accounts and rotate credentials for privileged users.
Audit the site for indicators of compromise, including unexpected files, users, and scheduled tasks.

Patch Information

The advisory identifies affected versions up to and including 1.4.2. Consult the Patchstack WP Mega Menu Vulnerability advisory and the Themeum plugin page for the fixed release number and upgrade guidance.

Workarounds

Deactivate and remove the WP Mega Menu plugin until a fixed version is installed.
Deploy a Web Application Firewall (WAF) rule that blocks serialized PHP payload patterns on plugin endpoints.
Enforce least privilege by removing administrator rights from accounts that do not require them.
Enable virtual patching through a managed WordPress security service if immediate removal is not possible.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-megamenu
wp plugin delete wp-megamenu

# Verify no remaining plugin files
find wp-content/plugins -type d -name 'wp-megamenu'