What is the CVSS score of CVE-2024-52413?

CVE-2024-52413 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.8%.

Which versions of Airin Blog are affected by CVE-2024-52413?

The dmcwebzone Airin Blog WordPress plugin (versions ≤1.6.1) contains a critical remote code execution vulnerability allowing unauthenticated attackers to fully compromise WordPress sites without…

How to fix or mitigate CVE-2024-52413?

Within 24 hours: Identify all WordPress installations using Airin Blog plugin versions 1.6.1 and earlier; immediately disable and deactivate the plugin to prevent exploitation. Within 7 days: Audit WordPress logs for exploitation indicators and unauthorized access; verify no backdoor accounts or malicious modifications were introduced. Within 30 days: Either remove the plugin entirely or migrate to an alternative blogging solution, as no vendor-released patch has been identified.

Airin Blog CVE-2024-52413

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2024-11-16 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Nov 16, 2024 - 22:15 nvd

N/A

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <= 1.6.1.

AnalysisAI

Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible through PHP Object Injection via deserialization of untrusted data. Unauthenticated network attackers can exploit this CWE-502 weakness to compromise affected WordPress sites with no user interaction, and while no public exploit identified at time of analysis, the EPSS score of 2.82% (86th percentile) indicates above-average exploitation interest.

Technical ContextAI

Airin Blog is a WordPress plugin distributed by dmcwebzone, and like many PHP-based plugins it appears to pass attacker-controlled data into PHP's unserialize() function or equivalent deserialization routine. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), which in the PHP/WordPress ecosystem typically manifests as PHP Object Injection - attackers craft serialized payloads that instantiate arbitrary classes already loaded in the WordPress runtime, triggering 'magic methods' such as __wakeup, __destruct, or __toString. When chained with POP (Property-Oriented Programming) gadgets available in WordPress core or other installed plugins, this commonly leads to arbitrary file write, SQL injection, or full remote code execution. Patchstack, the reporting party, specializes in WordPress plugin vulnerability discovery, which strongly suggests this is a WordPress ecosystem issue.

Affected ProductsAI

The dmcwebzone Airin Blog WordPress plugin is affected in all versions from initial release through and including 1.6.1, per the Patchstack-sourced description. No CPE strings, vendor advisory URL, or explicit fixed-version identifier were provided in the input data, so the exact downstream WordPress hosting environments cannot be enumerated beyond 'any WordPress site running Airin Blog <= 1.6.1.'

RemediationAI

No vendor-released patch identified at time of analysis based on the provided input - the description states the issue affects versions up to and including 1.6.1 but does not name a fixed version, so administrators should check the Airin Blog plugin page on wordpress.org and Patchstack's database (patchstack.com) for an updated release greater than 1.6.1 before applying. Until a confirmed fix is available, the most effective compensating control is to deactivate and remove the Airin Blog plugin entirely, which eliminates the vulnerable deserialization sink at the cost of losing the plugin's blog functionality. If removal is not acceptable, deploy a WordPress-aware WAF (Patchstack, Wordfence, or equivalent) with a virtual patch rule blocking serialized PHP object payloads (strings matching patterns like O:\d+: or a:\d+:) on requests to plugin endpoints, accepting the trade-off of potential false positives on legitimate serialized cookies or form fields. Additionally, restrict administrative access to the WordPress site via IP allow-listing and monitor for unexpected file modifications, since deserialization-to-RCE chains typically end in webshell drops.