Cyber Posture

CVE-2024-49222

Critical

Published: 07 January 2025

Published
07 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0064 70.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.

Security Summary

CVE-2024-2024-49222 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WPGuppy lite WordPress plugin from AmentoTech Private Limited. The flaw enables Object Injection and affects all versions of the plugin from n/a through 1.1.0.

An unauthenticated remote attacker (AV:N/AC:L/PR:N/UI:N) can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation can lead to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), earning a CVSS v3.1 base score of 9.8.

The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/wpguppy-lite/vulnerability/wordpress-wpguppy-plugin-1-1-0-php-object-injection-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-502

References