CVE-2021-24217

HIGH

Facebook for WordPress < 3.0.0 - Remote Code Execution via Unsafe Deserialization

Title source: llm
STIX 2.1

Description

The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://wpscan.com/vulnerability/509f2754-a1a1-4142-9126-ae023a88533a

Scores

CVSS v3 8.1
EPSS 0.0352
EPSS Percentile 87.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (1)
facebook/facebook < 3.0.0
Published Apr 12, 2021
Tracked Since Feb 18, 2026