CVE-2024-2008: 
WordPress vulnerability analysis and mitigation

The Modal Popup Box – Popup Builder, Show Offers And News in Popup plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-2008) affecting all versions up to and including 1.5.2. The vulnerability was discovered and disclosed by Wordfence, with the initial CVE assignment on April 3, 2024 (NVD).

The vulnerability exists in the awl_modal_popup_box_shortcode function where untrusted input can be deserialized, potentially leading to PHP Object Injection. The severity is rated as HIGH with a CVSS v3.1 base score of 8.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability could allow authenticated attackers with contributor-level access or higher to inject PHP Objects. When combined with a POP chain present in additional plugins or themes, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the target system (NVD).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack vector is network-accessible, requires low attack complexity, and no user interaction (NVD).

Users should update the Modal Popup Box plugin to a version newer than 1.5.2 if available. If updates are not available, consider removing or disabling the plugin until a patch is released (NVD).