CVE-2024-1770: 
WordPress vulnerability analysis and mitigation

The Meta Tag Manager plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-1770) affecting all versions up to and including 3.0.2. The vulnerability exists in the get_post_data function through deserialization of untrusted input. This security issue was discovered and reported by Wordfence (Wordfence Report).

The vulnerability stems from unsafe deserialization of untrusted input in the get_post_data function. While no POP (Property Oriented Programming) chain is present in the vulnerable plugin itself, the vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD Database).

If exploited, this vulnerability could allow authenticated attackers with contributor access or higher to inject PHP Objects. In cases where a POP chain is available through additional plugins or themes on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code (NVD Database).

The vulnerability requires authentication with contributor-level access or higher to exploit. The attack complexity is considered low, requiring no user interaction for exploitation (NVD Database).

A fix has been implemented and is available in the WordPress plugin repository. Users are advised to update their Meta Tag Manager plugin to a version newer than 3.0.2 (WordPress Plugin).