CVE-2024-8514 Overview
CVE-2024-8514 is a PHP Object Injection vulnerability in the Prisna GWT – Google Website Translator plugin for WordPress. The flaw affects all versions up to and including 1.4.11. The plugin deserializes untrusted input passed through the prisna_import parameter, allowing authenticated attackers with Administrator-level access to inject arbitrary PHP objects. The vulnerability is classified under CWE-502: Deserialization of Untrusted Data.
Critical Impact
While no Property-Oriented Programming (POP) chain exists in the plugin itself, the presence of a POP chain in another installed plugin or theme could enable arbitrary file deletion, sensitive data retrieval, or remote code execution.
Affected Products
- Prisna GWT – Google Website Translator plugin for WordPress
- All versions up to and including 1.4.11
- WordPress installations with Administrator-level user access
Discovery Timeline
- 2024-09-25 - CVE-2024-8514 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8514
Vulnerability Analysis
The Prisna GWT plugin exposes an import handler that accepts serialized data through the prisna_import request parameter. The handler invokes PHP's unserialize() function on the attacker-controlled input without validation. When PHP deserializes crafted input, it instantiates classes and invokes magic methods such as __wakeup(), __destruct(), and __toString() on the resulting objects. This behavior converts untrusted input into runtime object state and method execution.
The plugin itself does not ship classes suitable for chaining into code execution. However, WordPress environments typically load dozens of plugins and themes, each contributing classes to the autoloader. If any loaded class contains exploitable magic methods, an attacker can construct a POP chain that leverages those gadgets to delete files, exfiltrate secrets, or execute arbitrary PHP.
Root Cause
The root cause is unsafe deserialization of the prisna_import parameter in the plugin's admin handler. The vulnerable code path is located in the admin class of the plugin, referenced in the plugin source at admin.class.php line 267. Input passed to unserialize() should be treated as untrusted; the plugin does not enforce type constraints or use allowed_classes => false.
Attack Vector
Exploitation requires an authenticated session with Administrator privileges. The attacker submits a crafted serialized payload in the prisna_import parameter to the plugin's import endpoint. PHP deserializes the payload, and if a suitable gadget chain is present in the WordPress environment, execution flows through the chain to attacker-chosen sinks. Refer to the Wordfence vulnerability report for the disclosure record.
Detection Methods for CVE-2024-8514
Indicators of Compromise
- HTTP POST requests to WordPress admin endpoints containing the prisna_import parameter with serialized PHP data patterns such as O: (object), a: (array), or s: (string) markers.
- Unexpected file modifications, deletions, or new PHP files in the wp-content/plugins/ or wp-content/uploads/ directories following administrator activity.
- Anomalous PHP process behavior, including outbound network connections initiated by the web server user.
Detection Strategies
- Inspect web server and WordPress access logs for requests referencing the prisna_import parameter, particularly those originating from administrator accounts.
- Deploy a Web Application Firewall (WAF) rule that flags serialized PHP payloads submitted to plugin admin endpoints.
- Audit installed WordPress plugin versions and alert on any instance of Prisna GWT at version 1.4.11 or earlier.
Monitoring Recommendations
- Enable file integrity monitoring on WordPress core directories and plugin folders to detect unauthorized changes.
- Track WordPress administrator login events and correlate them with subsequent plugin configuration or import activity.
- Monitor PHP error logs for unserialize() warnings, malformed object notices, or class-not-found exceptions that may indicate exploitation attempts.
How to Mitigate CVE-2024-8514
Immediate Actions Required
- Update the Prisna GWT – Google Website Translator plugin to a version newer than 1.4.11 if available, or deactivate and remove the plugin.
- Review and reduce the number of accounts with Administrator privileges on affected WordPress sites.
- Enforce strong authentication and multi-factor authentication for all WordPress administrator accounts to limit the pool of users who can reach the vulnerable endpoint.
Patch Information
The vendor addressed the vulnerability in the plugin's source tree. Review the WordPress plugin changeset 3155285 for the applied fix. Site administrators should verify the installed plugin version reflects the patched revision and re-scan the environment after upgrading.
Workarounds
- Deactivate the Prisna GWT plugin until a verified patched version is installed.
- Restrict access to /wp-admin/ using IP allowlists or a reverse proxy to limit which sources can reach the vulnerable endpoint.
- Configure a WAF to block requests containing serialized PHP payloads in the prisna_import parameter.
- Audit installed plugins and themes for classes exposing dangerous magic methods to reduce the availability of POP chain gadgets.
# Example: locate installed plugin version and disable via WP-CLI
wp plugin get google-website-translator --field=version
wp plugin deactivate google-website-translator
wp plugin delete google-website-translator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
