CVE-2024-13899 is a PHP Object Injection vulnerability in the Mambo Importer WordPress plugin (versions up to 1.0). It arises from unsafe deserialization of untrusted input passed to the $data parameter in the fImportMenu function. The vulnerability requires an attacker to have Administrator-level privileges on the WordPress site. The plugin itself does not contain a POP chain, so exploitation depends on the presence of other plugins or themes that provide such a chain. If a suitable POP chain is available, the attacker could leverage this to perform destructive or unauthorized actions including file deletion, data disclosure, or code execution.

An attacker with Administrator privileges can inject PHP objects via deserialization, potentially leading to arbitrary code execution, file deletion, or data disclosure if a POP chain exists in other installed components. Without a POP chain, the vulnerability does not lead to impact. The CVSS score of 7.2 reflects high confidentiality, integrity, and availability impact under the condition that a POP chain is present.

No official patch or fix is currently documented for this vulnerability. Since exploitation requires Administrator access and the presence of a POP chain in other plugins or themes, limiting Administrator access and auditing installed plugins/themes for unsafe deserialization gadgets may reduce risk. Monitor vendor advisories for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.