CVE-2024-13906 is a PHP Object Injection vulnerability in the Gallery by BestWebSoft plugin for WordPress, affecting all versions up to 4.7.3. It arises from unsafe deserialization of untrusted input in the 'import_gallery_from_csv' function. An attacker with Administrator privileges can inject PHP objects. However, the plugin alone does not contain a POP chain to enable exploitation. If other plugins or themes installed on the WordPress site contain POP chains, this vulnerability could be leveraged to perform destructive or unauthorized actions such as file deletion, sensitive data access, or remote code execution.

The vulnerability allows high-privileged attackers (Administrator or above) to inject PHP objects via deserialization. Without a POP chain in the vulnerable plugin, exploitation alone does not lead to impact. If a POP chain exists in other installed plugins or themes, the attacker could delete arbitrary files, retrieve sensitive information, or execute arbitrary code, leading to full compromise of the affected WordPress site.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and review installed plugins and themes for known POP chains that could be combined with this vulnerability. Monitor vendor channels for updates and apply patches promptly once released.