CVE-2024-30228: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability was discovered in Hercules Design Hercules Core, affecting versions through 6.4. The vulnerability was reported on February 18, 2024, and publicly disclosed on March 26, 2024. This security issue has been assigned CVE-2024-30228 and affects WordPress installations using the Hercules Core plugin (Patchstack).

The vulnerability is classified as a PHP Object Injection issue, which falls under the CWE-502 (Deserialization of Untrusted Data) category. It has received a CVSS v3.1 base score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges (Patchstack).

The vulnerability could potentially allow malicious actors to execute code injection, SQL injection, path traversal, or denial of service attacks if a proper POP chain is present. The high CVSS score of 9.9 indicates that this vulnerability is considered highly dangerous and is expected to become mass exploited (Patchstack).

The vulnerability requires Subscriber or higher level privileges to exploit. Given its critical severity rating and low complexity, there is a high risk of exploitation. The vulnerability was discovered by security researcher Dave Jong from Patchstack (Patchstack).

Users are strongly advised to update to Hercules Core version 6.5 or later, which contains the fix for this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).