CVE-2024-13789 is a critical PHP Object Injection vulnerability (CWE-502) in the ravpage WordPress plugin (versions up to 2.31). It arises from unsafe deserialization of untrusted input via the 'paramsv2' parameter. The vulnerability itself does not enable exploitation unless a PHP POP chain is available through other installed plugins or themes. When such a POP chain is present, attackers can leverage this to perform high-impact actions including arbitrary file deletion, sensitive data disclosure, or remote code execution. The CVSS 3.1 base score is 9.8, reflecting the potential severity if exploited. No patch or official remediation has been documented yet.

The vulnerability allows unauthenticated attackers to inject PHP objects through deserialization, which can lead to critical impacts such as arbitrary file deletion, data disclosure, or code execution, but only if a suitable POP chain exists in other installed components. Without a POP chain, the vulnerability cannot be exploited to cause harm. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should review installed plugins and themes for known POP chains that could be leveraged and consider disabling or removing the ravpage plugin if not essential. Monitor vendor channels for updates or official fixes.