Partners WordPress Plugin CVE-2024-56059
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Partners plugin
-
DeliverySend crafted request with __proto__ payload
-
ExploitPollute Object prototype globally
-
ExecutionTrigger Object Injection in downstream sink
-
PersistExecute attacker-controlled code or escalate privileges
-
ImpactEstablish persistent admin access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site with the farinspace Partners plugin versions 0.2.0 or earlier installed and activated. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and no specific configuration beyond the plugin being installed. The only meaningful limiting factor is the relatively narrow install base of the Partners plugin compared to large-footprint plugins; exploitation does not require a non-default setup, specific WordPress version, or any user action. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates remote, unauthenticated, low-complexity exploitation with full CIA impact, which is consistent with the 9.8 base score. EPSS at 26.25% (96th percentile) is unusually high and indicates measurable real-world interest, even though no public PoC has been catalogued and the CVE is not in CISA KEV - suggesting potential rather than confirmed mass exploitation. The Patchstack origin (audit@patchstack.com) and the WordPress plugin ecosystem context further raise concern because automated scanning of WP plugins is pervasive. Net assessment: a real prioritization target, especially given the Partners plugin's installed base on small-business/affiliate sites where patching cadence is typically slow. One caveat: the description does not pinpoint the exact sink that converts prototype pollution into Object Injection, so the path to full RCE is inferred from the CWE/tags rather than confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Partners plugin, supplying a JSON or array payload whose keys include __proto__ or constructor.prototype with attacker-chosen properties. The polluted prototype is then read by a later plugin or WordPress core code path during request handling, triggering Object Injection that the attacker chains to arbitrary code execution or administrative takeover. No public exploit identified at time of analysis, but the low attack complexity and zero-privilege requirement make opportunistic mass scanning realistic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unauthenticated attackers to inject properties into base Object prototypes, leading to object injection and potentially remote code execution. The CVSS 9.8 score combined with a notable EPSS of 26.25% (96th percentile) signals elevated exploitation risk, though no public exploit identified at time of analysis and the issue is not present in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - the advisory states the issue affects versions up to and including 0.2.0 with no fixed version listed. Until a patched release is published by farinspace, administrators should deactivate and remove the Partners plugin from WordPress installations, particularly on internet-facing sites, as the plugin is reachable by unauthenticated remote attackers per the CVSS vector. Compensating controls include placing the WordPress site behind a WAF with rules blocking request bodies containing __proto__, constructor.prototype, or prototype keys (trade-off: may false-positive on legitimate JSON APIs that legitimately reference these properties), restricting access to plugin endpoints via IP allowlisting at the web server level, and monitoring the Patchstack and farinspace plugin pages for an updated release.
Affected ProductsAI
The affected product is the farinspace Partners WordPress plugin, all versions from initial release through and including 0.2.0 (n/a through <= 0.2.0 per the advisory). No CPE string was provided in the input data, and no vendor advisory URL was included beyond the Patchstack reporter attribution; defenders should consult the Patchstack database entry for CVE-2024-56059 for the canonical advisory.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, 'Prototype Pollution'), a JavaScript/PHP class of weakness where untrusted input is merged into objects without filtering reserved keys like __proto__, prototype, or constructor. In a WordPress plugin context this typically manifests in recursive merge, extend, or settings-import routines that walk user-supplied key paths. Once base prototype properties are polluted, downstream code paths that read properties without hasOwnProperty checks can be coerced into unintended branches - enabling Object Injection (as tagged) and, in WordPress, can escalate to gadget-chain code execution depending on plugin/theme stacks loaded.
Know when Prototype Pollution gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.
Executive ViewAI
The farinspace Partners WordPress plugin (versions 0.2.0 and earlier) contains a critical prototype pollution vulnerability allowing unauthenticated attackers to inject malicious code with potential remote code execution capability. Any WordPress installation running this plugin faces immediate risk of complete site compromise and unauthorized data access. Urgent removal is required due to the absence of available security patches.
No vendor-released patch identified at time of analysis. Interim mitigations if immediate removal is infeasible: implement Web Application Firewall rules to detect and block prototype pollution exploitation patterns; enforce restrictive Content Security Policy headers; and monitor application logs for suspicious object injection attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. Rated critical severity (
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to co
This affects the package ini before 1.3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
GitHub PoC
Exploit-DB