CVE-2024-56291
Published: 07 January 2025
Description
Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.
Security Summary
CVE-2024-56291 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the plainware PlainInventory z-inventory-manager WordPress plugin, enabling Object Injection. The issue affects all versions of PlainInventory from n/a through 3.1.6 and was published on 2025-01-07.
Attackers can exploit this vulnerability remotely over the network (AV:N) with no required privileges (PR:N) or user interaction (UI:N), though it involves high attack complexity (AC:H). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 base score of 8.1 and unchanged scope (S:U).
The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/z-inventory-manager/vulnerability/wordpress-plaininventory-inventory-management-plugin-plugin-3-1-6-php-object-injection-vulnerability?_s_id=cve.
Details
- CWE(s)