CVE-2021-24384: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2021-24384) affects the JoomSport WordPress plugin versions 5.1.7 and below. It was discovered on May 13, 2021, and publicly disclosed on June 8, 2021. The vulnerability is related to an Object Injection issue in the plugin's AJAX functionality (WPScan).

The vulnerability exists in the joomsportmdload AJAX action of the plugin, which is registered for both authenticated and unauthenticated users. The issue stems from unsafe deserialization of user input from the shattr POST parameter, leading to a PHP Object Injection vulnerability. The vulnerability received a CVSS score of 6.5 (medium severity) (WPScan).

While the JoomSport plugin itself doesn't contain a suitable gadget chain for exploitation, the vulnerability could potentially be more severe if other installed plugins provide exploitable gadget chains. This could potentially lead to more serious issues, including Remote Code Execution (RCE) (WPScan).

The vulnerability has been patched in version 5.1.8 of the JoomSport plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).