CVE-2024-7486: 
WordPress vulnerability analysis and mitigation

The MultiPurpose theme for WordPress contains a PHP Object Injection vulnerability (CVE-2024-7486) affecting all versions up to and including 1.2.0. The vulnerability was discovered in the theme's handling of the 'wpeden_post_meta' post meta functionality (NVD).

The vulnerability stems from the unsafe deserialization of untrusted input through the 'wpeden_post_meta' post meta functionality. The issue has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) (NVD).

While no known POP (Property Oriented Programming) chain is present in the vulnerable software itself, if a POP chain exists via additional plugins or themes installed on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the affected system (NVD).

The vulnerability can be exploited by authenticated attackers with Contributor-level access or higher privileges. The attack requires network access and has low attack complexity, making it relatively straightforward to exploit for authenticated users (NVD).