CVE-2024-1772: 
WordPress vulnerability analysis and mitigation

The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-1772) affecting all versions up to and including 3.6.4. The vulnerability was publicly disclosed on February 22, 2024, and was discovered by researcher Francesco Carlucci (NVD).

The vulnerability stems from the insecure deserialization of untrusted input from the play_podcast_data post meta. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Currently, no known POP (Property Oriented Programming) chain exists within the vulnerable plugin itself (NVD).

If exploited successfully, particularly in cases where a POP chain is present through additional plugins or themes on the target system, this vulnerability could enable attackers to delete arbitrary files, retrieve sensitive data, or execute malicious code on the affected system (NVD).

The vulnerability can be exploited by authenticated attackers with contributor-level access or higher privileges. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) with no user interaction (UI:N) (NVD).