CVE-2024-10936 is a high-severity PHP Object Injection vulnerability in the String locator WordPress plugin (versions up to 2.6.6). It arises from unsafe deserialization of untrusted data in the 'recursive_unserialize_replace' function. This vulnerability allows unauthenticated attackers to inject PHP objects. However, exploitation requires an administrator to trigger the vulnerability by performing a search and replace operation. The plugin itself lacks a known POP chain, but if combined with other plugins or themes that provide such chains, it could lead to arbitrary file deletion, sensitive data disclosure, or code execution. No patch or official remediation has been documented yet.

Successful exploitation can lead to high-impact consequences including arbitrary file deletion, sensitive data disclosure, and remote code execution, but only if a POP chain is available through other installed plugins or themes. The vulnerability requires administrator interaction to trigger, limiting direct exploitation by unauthenticated attackers. The CVSS score of 8.8 reflects the high potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid performing search and replace operations in the String locator plugin. Review installed plugins and themes for potential POP chains that could be leveraged in combination with this vulnerability. Monitor vendor channels for updates and apply patches promptly once available.