CVE-2024-29800: 
PHP vulnerability analysis and mitigation

The Timber WordPress plugin contains a Deserialization of Untrusted Data vulnerability (CVE-2024-29800) affecting versions up to and including 1.23.0. The vulnerability was discovered by Trình Vũ from VNPT-VCI and was publicly disclosed on May 7, 2024. This security issue affects the Timber Team & Contributors' Timber library plugin for WordPress (Patchstack, WPScan).

The vulnerability is classified as a PHP Object Injection vulnerability that occurs through the deserialization of untrusted input. It has been assigned a CVSS v3.1 base score of 8.0 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The issue is tracked under CWE-502 (Deserialization of Untrusted Data). While no known POP (Property-Oriented Programming) chain is present in the vulnerable software itself, the presence of additional plugins or themes could potentially provide an exploitation chain (WPScan).

The vulnerability could potentially allow authenticated attackers with Administrator-level access to inject PHP Objects. If a POP chain is available through additional installed plugins or themes, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the affected system (WPScan).

The vulnerability requires an authenticated user with Administrator-level privileges to exploit. While this significantly limits the potential attack surface, the presence of a POP chain in the environment could lead to serious security implications (WPScan).

The vulnerability has been fixed in version 1.23.1 of the Timber plugin. Site administrators are strongly advised to update to this version or later to remediate the security issue (Patchstack).