CVE-2024-3070: 
WordPress vulnerability analysis and mitigation

The Last Viewed Posts by WPBeginner plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-3070) affecting all versions up to and including 1.0.0. The vulnerability exists in the deserialization of untrusted input from the LastViewedPosts Cookie, which can be exploited by unauthenticated attackers (NVD).

The vulnerability stems from unsafe deserialization of untrusted input from the LastViewedPosts Cookie. While no known POP (Property-Oriented Programming) chain is present in the vulnerable plugin itself, if a POP chain exists via additional plugins or themes installed on the target system, it could enable exploitation. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Wordfence).

If successfully exploited through a POP chain present in additional plugins or themes, this vulnerability could allow attackers to delete arbitrary files, retrieve sensitive data, or execute code on the target system (NVD).

The vulnerability can be exploited by unauthenticated attackers remotely, requiring no user interaction or special privileges. The attack vector involves manipulating the LastViewedPosts Cookie with malicious serialized data (NVD).