CVE-2024-29800 WordPress Timber plugin <= 1.23.0 - Deserialization of untrusted data vulnerability
An attacker can execute arbitrary code by exploiting a deserialization vulnerability in the Timber WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29800?
CVE-2024-29800 is a high-severity unsafe deserialization vulnerability in Timber, published on 9 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Deserialization of Untrusted Data vulnerability in Timber Team & Contributors Timber.This issue affects Timber: from n/a through 1.23.0.
Weakness: CWE-502
Which versions are affected by CVE-2024-29800?
6 open source packages ship an affected version, including timber/timber.
| Package | Affected | Fixed in |
|---|---|---|
timber/timber Packagist | From 0.16.6 | 1.23.1 |
timber/timber Packagist | From 0.16.6 | 1.23.1 |
timber/timber Packagist | From 1.24.0 | 1.24.1 |
timber/timber Packagist | From 1.24.0 | 1.24.1 |
timber/timber Packagist | From 2.0.0 | 2.1.0 |
timber/timber Packagist | From 2.0.0 | 2.1.0 |
How do I fix CVE-2024-29800?
Upgrade timber/timber to a fixed version for your release line: 1.23.1, 1.24.1 or 2.1.0.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-29800 being exploited?
There is no known exploitation of CVE-2024-29800 in the wild and no public exploit code.
Sources
Also known as GHSA-6363-v5m4-fvq3.