CVE-2024-11501 is a deserialization of untrusted data vulnerability (CWE-502) in the webdzier Gallery WordPress plugin. It affects all versions up to and including 1.3. The vulnerability arises from unsafe deserialization of the wd_gallery_$id parameter, allowing authenticated users with Contributor or higher privileges to perform PHP Object Injection. While the plugin does not include a known POP chain, the presence of additional plugins or themes with gadget chains could enable severe impacts such as arbitrary file deletion, sensitive data retrieval, or remote code execution. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and partial privileges required.

Successful exploitation can lead to high-impact consequences including confidentiality, integrity, and availability breaches. Specifically, attackers could delete arbitrary files, access sensitive information, or execute arbitrary code on the affected system if a suitable POP chain exists in the environment. The vulnerability requires authenticated access at Contributor level or above, limiting exposure to users with some level of trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and higher to trusted users only. Monitor for updates from the vendor or WordPress plugin repository to apply patches once released. Avoid installing untrusted plugins or themes that might provide gadget chains enabling exploitation.