CVE-2024-13784: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2024-13784 is a PHP Object Injection vulnerability in the Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress, affecting all versions up to and including 1.8.5. The flaw arises from deserialization of untrusted input submitted via plugin forms, enabling unauthenticated attackers to inject arbitrary PHP objects. Exploitation impact is conditional on the presence of a compatible POP (Property-Oriented Programming) chain in another installed plugin or theme. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is improper deserialization of user-supplied form submission data (CWE-502: Deserialization of Untrusted Data). An unauthenticated attacker can craft a malicious serialized PHP object and submit it via a form handled by the ARForms plugin; the plugin deserializes this input without adequate validation or sanitization. Because no POP chain exists within ARForms itself, the vulnerability's practical impact depends entirely on whether another installed plugin or theme provides a usable gadget chain — a common scenario in WordPress environments with many third-party components (GitHub Advisory).

If a compatible POP chain is present in the WordPress environment, a remote unauthenticated attacker could delete arbitrary files, retrieve sensitive data (including credentials or configuration files), or achieve remote code execution on the server. Even without code execution, file deletion could result in site defacement or denial of service, while data retrieval could expose user PII, database credentials, or API keys. The scope of impact scales with the capabilities of any available gadget chain in co-installed plugins or themes (GitHub Advisory).

As of the time of disclosure, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The vulnerability requires no authentication and no user interaction, making it trivially exploitable from a network perspective once a suitable POP chain is identified. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS score data was not available in the referenced sources at time of reporting.

1. Reconnaissance: Identify WordPress sites running the ARForms plugin (versions ≤ 1.8.5) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Enumerate co-installed plugins/themes: Identify other plugins or themes installed on the target that contain known PHP gadget chains (POP chains), such as those catalogued in tools like PHPGGC.
3. Craft malicious serialized payload: Using PHPGGC or a custom script, generate a serialized PHP object payload targeting a known gadget chain present in a co-installed component (e.g., a chain that triggers file deletion, data exfiltration, or code execution).
4. Submit payload via form: Submit the crafted serialized payload as form input through any ARForms-powered form on the target site (e.g., a contact form or survey), exploiting the plugin's lack of input validation on deserialization.
5. Trigger POP chain: The deserialized object invokes the gadget chain during PHP object lifecycle events (e.g., __wakeup, __destruct), executing the attacker's intended action — such as writing a web shell, deleting files, or exfiltrating data (GitHub Advisory).

• Network: Unusual HTTP POST requests to ARForms form endpoints containing serialized PHP data (e.g., strings beginning with O: or a: patterns in POST body parameters).
• Logs: WordPress or web server access logs showing repeated form submissions with abnormally large or encoded POST bodies; PHP error logs referencing unexpected object instantiation or __wakeup/__destruct method calls.
• File System: Unexpected new PHP files (web shells) in the WordPress uploads directory or plugin directories; missing or modified core WordPress files indicating arbitrary file deletion.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) following form submission activity.

Update the ARForms plugin to a version newer than 1.8.5 as soon as a patched release is available from the vendor (GitHub Advisory). In the interim, audit all co-installed plugins and themes for known PHP gadget chains and remove any that are unnecessary or known to contain exploitable POP chains. Implement a Web Application Firewall (WAF) with rules to detect and block serialized PHP object payloads in form submissions. Restrict access to form endpoints where possible and monitor for anomalous POST request patterns.