What is the CVSS score of CVE-2024-56059?

CVE-2024-56059 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 26.2%.

Which versions of Partners WordPress Plugin are affected by CVE-2024-56059?

The farinspace Partners WordPress plugin (versions 0.2.0 and earlier) contains a critical prototype pollution vulnerability allowing unauthenticated attackers to inject malicious code with potential…

How to fix or mitigate CVE-2024-56059?

Within 24 hours: Deactivate and uninstall the farinspace Partners plugin (all versions ≤0.2.0) from all WordPress instances. Within 7 days: Inventory remaining dependencies on this plugin, identify approved replacement solutions, and monitor vendor advisories for patches. Within 30 days: Complete migration to alternative plugins and document incident response in change management.

Partners WordPress Plugin CVE-2024-56059

CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2024-12-18 audit@patchstack.com

Code Injection Prototype Pollution

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.8 (CRITICAL)

CVE Published

Dec 18, 2024 - 12:15 nvd

N/A

DescriptionCVE.org

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.

AnalysisAI

Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unauthenticated attackers to inject properties into base Object prototypes, leading to object injection and potentially remote code execution. The CVSS 9.8 score combined with a notable EPSS of 26.25% (96th percentile) signals elevated exploitation risk, though no public exploit identified at time of analysis and the issue is not present in CISA KEV.

Technical ContextAI

The flaw is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, 'Prototype Pollution'), a JavaScript/PHP class of weakness where untrusted input is merged into objects without filtering reserved keys like __proto__, prototype, or constructor. In a WordPress plugin context this typically manifests in recursive merge, extend, or settings-import routines that walk user-supplied key paths. Once base prototype properties are polluted, downstream code paths that read properties without hasOwnProperty checks can be coerced into unintended branches - enabling Object Injection (as tagged) and, in WordPress, can escalate to gadget-chain code execution depending on plugin/theme stacks loaded.

Affected ProductsAI

The affected product is the farinspace Partners WordPress plugin, all versions from initial release through and including 0.2.0 (n/a through <= 0.2.0 per the advisory). No CPE string was provided in the input data, and no vendor advisory URL was included beyond the Patchstack reporter attribution; defenders should consult the Patchstack database entry for CVE-2024-56059 for the canonical advisory.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory states the issue affects versions up to and including 0.2.0 with no fixed version listed. Until a patched release is published by farinspace, administrators should deactivate and remove the Partners plugin from WordPress installations, particularly on internet-facing sites, as the plugin is reachable by unauthenticated remote attackers per the CVSS vector. Compensating controls include placing the WordPress site behind a WAF with rules blocking request bodies containing __proto__, constructor.prototype, or prototype keys (trade-off: may false-positive on legitimate JSON APIs that legitimately reference these properties), restricting access to plugin endpoints via IP allowlisting at the web server level, and monitoring the Patchstack and farinspace plugin pages for an updated release.