Cyber Posture

CVE-2024-13787

Critical

Published: 05 March 2025

Published
05 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0029 52.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2024-13787 is a PHP Object Injection vulnerability (CWE-502) affecting the VEDA - MultiPurpose WordPress Theme for WordPress in all versions up to and including 4.2. The flaw stems from deserialization of untrusted input within the 'veda_backup_and_restore_action' function, enabling the injection of a PHP Object. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to inject a PHP Object. While no known PHP Object Injection (POP) chain exists in the vulnerable theme itself—meaning it has no direct impact unless another plugin or theme providing a POP chain is installed—the presence of such a chain could allow attackers to delete arbitrary files, retrieve sensitive data, or execute arbitrary code, depending on the chain's capabilities.

Advisories and additional details are available via references including the theme's page on ThemeForest (https://themeforest.net/item/veda-multipurpose-theme/15860489) and Wordfence's threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/d0966138-b28b-4c03-a2cf-b51c5f478276?source=cve). Practitioners should consult these for any patch information or mitigation guidance specific to the theme.

Details

CWE(s)
CWE-502

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Deserialization vulnerability in public-facing WordPress theme enables exploitation for potential RCE/data access/file ops if POP chain present from other components.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References