CVE-2024-11409 is a PHP Object Injection vulnerability in the priyajain2802 Grid View Gallery WordPress plugin affecting all versions up to 1.0. The vulnerability arises from unsafe deserialization of untrusted input passed through the cs_all_photos_details parameter. Attackers with Editor-level or higher privileges can inject PHP objects. Although the plugin does not contain a known POP chain internally, the presence of a POP chain in other installed plugins or themes could enable severe impacts such as arbitrary file deletion, sensitive data retrieval, or remote code execution. The CVSS 3.1 base score is 7.2, reflecting high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with Editor-level or higher access can exploit this vulnerability to inject PHP objects via deserialization. Without a POP chain in the plugin itself, direct exploitation is limited, but if a POP chain exists in other installed components, the attacker could delete files, access sensitive information, or execute arbitrary code, severely compromising the affected WordPress site.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Editor-level access to trusted users only and consider disabling or removing the Grid View Gallery plugin if possible. Monitor for updates from the plugin author or WordPress security advisories to apply official fixes once available.