CVE-2024-10079 is a deserialization of untrusted data vulnerability (CWE-502) in the WP Easy Post Types WordPress plugin (up to version 1.4.4). It arises from unsafe deserialization of the 'text' parameter in the 'ajax_import_content' function, allowing authenticated users with subscriber-level or higher permissions to inject PHP objects. Although the plugin itself does not contain a gadget chain to exploit this injection, exploitation is possible if other installed plugins or themes provide such chains, potentially leading to arbitrary file deletion, sensitive data disclosure, or remote code execution. The vulnerability is network exploitable with low attack complexity and no user interaction required.

Successful exploitation could lead to high impact including confidentiality, integrity, and availability breaches. Specifically, attackers could delete arbitrary files, retrieve sensitive information, or execute arbitrary code if a suitable gadget chain exists in the environment. The vulnerability requires authenticated access at subscriber level or above, limiting exposure to authenticated users only. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting plugin usage to trusted users and minimizing the installation of additional plugins or themes that could provide gadget chains may reduce risk. Applying the principle of least privilege to user roles can also help limit potential exploitation.