CVE-2024-10587 is a PHP Object Injection vulnerability (CWE-502) in the funnelforms Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free WordPress plugin, affecting all versions up to 3.7.5.1. It arises from unsafe deserialization of untrusted input, allowing authenticated users with Contributor-level access or higher to inject PHP objects. Although the plugin itself lacks a known POP chain, exploitation may be possible if other installed plugins or themes provide such chains, potentially leading to arbitrary file deletion, sensitive data disclosure, or remote code execution. The vulnerability is rated high severity with a CVSS score of 8.8. No patch or vendor advisory indicating a fix is currently provided.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject PHP objects via deserialization. Without a POP chain, direct exploitation is limited, but if additional plugins or themes on the target system provide a POP chain, the attacker could achieve critical impacts including arbitrary file deletion, sensitive data retrieval, or remote code execution. This elevates the risk to confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and review installed plugins and themes for potential POP chains that could be leveraged in exploitation. Monitor for updates from the funnelforms vendor and apply patches promptly once available.