CVE-2024-5724: Photo Video Gallery Master RCE Vulnerability

CVE-2024-5724 Overview

The Photo Video Gallery Master plugin for WordPress contains a PHP Object Injection vulnerability affecting all versions up to and including 1.5.3. The flaw exists in the deserialization of the untrusted PVGM_all_photos_details parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary PHP objects into the application. No known Property-Oriented Programming (POP) chain exists in the plugin itself. However, when a POP chain is present through another installed plugin or theme, attackers can delete arbitrary files, retrieve sensitive data, or execute code on the server.

Critical Impact
Authenticated contributors can inject PHP objects that, combined with a POP chain from any other installed component, lead to arbitrary file deletion, sensitive data exposure, or remote code execution.

Affected Products

Webhuntinfotech Photo Video Gallery Master plugin for WordPress
All versions up to and including 1.5.3
WordPress sites with Contributor-level or higher user accounts enabled

Discovery Timeline

2024-06-19 - CVE-2024-5724 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5724

Vulnerability Analysis

The vulnerability is a PHP Object Injection flaw classified under [CWE-502] (Deserialization of Untrusted Data). The plugin passes attacker-controlled input from the PVGM_all_photos_details parameter directly into PHP's unserialize() function. This allows the attacker to instantiate arbitrary PHP objects within the application context.

While the plugin itself does not contain a usable POP chain, WordPress environments typically host dozens of plugins and themes. Any of these can introduce magic methods such as __destruct(), __wakeup(), or __toString() that become exploitable gadgets once an object is deserialized. This transforms the injection into arbitrary file operations, information disclosure, or code execution.

Root Cause

The root cause is unsafe deserialization of user-supplied input. The plugin trusts the PVGM_all_photos_details parameter and passes it to unserialize() without validation, type checking, or use of safer alternatives such as json_decode(). Contributor-level authentication is enforced by the plugin's action handler, but that trust boundary is insufficient because contributors are frequently untrusted users on multi-author WordPress sites.

Attack Vector

Exploitation requires network access to the WordPress site and a valid Contributor-level account. An attacker crafts a serialized PHP object payload targeting a gadget chain from another installed plugin or theme. The attacker submits this payload through the PVGM_all_photos_details parameter to the vulnerable endpoint. When the plugin deserializes the payload, PHP invokes the object's magic methods, triggering the gadget chain. Depending on the available gadgets, this leads to arbitrary file deletion, sensitive data retrieval, or remote code execution under the web server user.

For technical details, see the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-5724

Indicators of Compromise

Requests containing the PVGM_all_photos_details parameter with values beginning with O:, a:, or s: indicating serialized PHP data
Unexpected file deletions or modifications within the WordPress wp-content directory following contributor activity
New or modified PHP files in upload directories after requests to the plugin's endpoints
Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts

Detection Strategies

Inspect web server access logs for POST requests carrying PVGM_all_photos_details with serialized object markers
Monitor WordPress audit logs for contributor accounts submitting content containing base64-encoded or serialized payloads
Deploy a Web Application Firewall (WAF) rule that blocks serialized PHP object patterns in request bodies
Correlate contributor authentication events with subsequent file system changes on the web server

Monitoring Recommendations

Enable file integrity monitoring across the WordPress installation, focusing on wp-content/plugins and wp-content/uploads
Track process execution originating from the web server user account to identify post-exploitation activity
Log and review all requests to the Photo Video Gallery Master plugin endpoints until remediation is complete
Alert on newly created contributor or higher-privilege accounts on affected WordPress instances

How to Mitigate CVE-2024-5724

Immediate Actions Required

Deactivate and remove the Photo Video Gallery Master plugin from all WordPress installations until a patched version is confirmed available
Audit existing Contributor, Author, Editor, and Administrator accounts and remove untrusted or unused accounts
Rotate credentials for all WordPress users with Contributor-level access or higher
Review installed plugins and themes for known POP chain gadgets and remove those no longer required

Patch Information

No vendor patch is referenced in the enriched advisory data. Site operators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for a release above version 1.5.3 that removes the call to unserialize() on untrusted input.

Workarounds

Restrict the Contributor role using a capability management plugin so untrusted users cannot invoke the vulnerable endpoint
Deploy WAF rules that block requests containing serialized PHP object signatures in the PVGM_all_photos_details parameter
Disable PHP object deserialization at the application layer where feasible, or override unserialize() with allowed_classes => false
Isolate the WordPress process with restrictive file system permissions to limit the impact of arbitrary file operations

bash

# Example ModSecurity rule to block serialized PHP objects in the vulnerable parameter
SecRule ARGS:PVGM_all_photos_details "@rx ^(O|a|s):[0-9]+:" \
    "id:1005724,phase:2,deny,status:403,\
    msg:'CVE-2024-5724 PHP Object Injection attempt blocked',\
    tag:'CWE-502'"