CVE-2024-1770

The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the get_post_data function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502

• https://plugins.trac.wordpress.org/changeset/3054910/meta-tag-manager/trunk/meta-tag-manager.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec1aed2-d299-4fa9-add6-10b63ed6aa30?source=cve
• https://plugins.trac.wordpress.org/changeset/3054910/meta-tag-manager/trunk/meta-tag-manager.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec1aed2-d299-4fa9-add6-10b63ed6aa30?source=cve

Published

Mar 28, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1764Improper privilege management in Just-in-time (JIT) elevatio…7.6
• CVE-2024-1765Cloudflare Quiche (through version 0.19.1/0.20.0) was affect…7.5
• CVE-2024-1766The Download Manager plugin for WordPress is vulnerable to S…5.4
• CVE-2024-1767The Blocksy theme for WordPress is vulnerable to Stored Cros…5.4
• CVE-2024-1768The Clever Fox plugin for WordPress is vulnerable to Stored …5.4
• CVE-2024-1769The JM Twitter Cards plugin for WordPress is vulnerable to I…5.3
• CVE-2024-1771The Total theme for WordPress is vulnerable to unauthorized …4.3
• CVE-2024-1772The Play.ht – Make Your Blog Posts Accessible With Text to S…8.8
• CVE-2024-1773The PDF Invoices and Packing Slips For WooCommerce plugin fo…8.8
• CVE-2024-1774The Customily Product Personalizer plugin for WordPress is v…7.2
• CVE-2024-1775The Nextend Social Login and Register plugin for WordPress i…5.4
• CVE-2024-1776The Admin side data storage for Contact Form 7 plugin for Wo…7.2