CVE-2024-38759: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability (CVE-2024-38759) was discovered in WP MEDIA SAS Search & Replace WordPress plugin affecting versions up to 3.2.2. The vulnerability was discovered by Trinh Vu (Sonicrrrr) from VNPT-VCI and was publicly disclosed on July 11, 2024 (WPScan, Patchstack).

The vulnerability is classified as a PHP Object Injection vulnerability that allows unauthenticated attackers to inject PHP Objects through the deserialization of untrusted input. While no known POP (Property-Oriented Programming) chain is present in the vulnerable software itself, the presence of additional plugins or themes could potentially create an exploit chain. The vulnerability has received varying CVSS scores: NIST assigned a Critical score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), while Patchstack rated it as Medium with a score of 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data) (NVD, WPScan).

If exploited, particularly in combination with a POP chain through additional plugins or themes, this vulnerability could enable attackers to delete arbitrary files, retrieve sensitive data, or potentially execute code on the affected system (WPScan).

The vulnerability requires no authentication to exploit, though its actual exploitation complexity varies according to different assessments. While NIST suggests low complexity, Patchstack indicates high complexity in their CVSS scoring (NVD, Patchstack).

The vulnerability has been patched in version 3.2.3 of the Search & Replace plugin. Users are advised to update to version 3.2.3 or later to remediate this security issue (Patchstack).