CVE-2024-3954

The Ditty plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.1.38 via deserialization of untrusted input when adding a new ditty. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081335%40ditty-news-ticker&new=3081335%40ditty-news-ticker&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0f00b138-5c4b-4f75-94b1-82721cba2668?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081335%40ditty-news-ticker&new=3081335%40ditty-news-ticker&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0f00b138-5c4b-4f75-94b1-82721cba2668?source=cve

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39534An Incorrect Comparison vulnerability in the local address v…5.4
• CVE-2024-39535An Improper Check for Unusual or Exceptional Conditions vuln…7.1
• CVE-2024-39536A Missing Release of Memory after Effective Lifetime vulnera…6
• CVE-2024-39537An Improper Restriction of Communication Channel to Intended…6.9
• CVE-2024-39538A Buffer Copy without Checking Size of Input vulnerability i…7.1
• CVE-2024-39539A Missing Release of Memory after Effective Lifetime vulnera…6
• CVE-2024-39540An Improper Check for Unusual or Exceptional Conditions vuln…8.7
• CVE-2024-39541An Improper Handling of Exceptional Conditions vulnerability…7.1
• CVE-2024-39542An Improper Validation of Syntactic Correctness of Input vul…8.7
• CVE-2024-39543A Buffer Copy without Checking Size of Input vulnerability i…7.1
• CVE-2024-39544An Incorrect Default Permissions vulnerability in the comman…5.1
• CVE-2024-39545An Improper Check for Unusual or Exceptional Conditions vuln…8.7