The Vimeography: Vimeo Video Gallery WordPress Plugin is vulnerable to PHP Object Injection through unsafe deserialization of the vimeography_duplicate_gallery_serialized parameter in the duplicate_gallery function. This vulnerability affects all versions up to and including 2.3.2. Exploitation requires authenticated access at contributor level or higher. The plugin does not contain a POP chain internally, but if other installed plugins or themes provide one, attackers could leverage this to perform destructive or unauthorized actions such as deleting files, retrieving sensitive information, or executing arbitrary code.

Successful exploitation allows authenticated contributors or higher to inject PHP objects, potentially leading to high-impact consequences including confidentiality, integrity, and availability breaches. Without a POP chain in the plugin itself, direct exploitation is limited; however, combined with other vulnerable components, it could result in arbitrary file deletion, sensitive data exposure, or remote code execution.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict contributor-level access and review installed plugins and themes for potential POP chains that could be leveraged in conjunction with this vulnerability. Consider disabling or removing the Vimeography plugin if contributor access cannot be tightly controlled.