VULNERABILITY INTELLIGENCE

CVE-2021-24217

CVSS score8.1 HIGH
EPSS probability3.52%
CISA KEVNot currently listed
Published2021-04-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.

Weakness classification

  • contact@wpscan.com: CWE-502

Primary references