CVE-2024-1770 is a deserialization of untrusted data vulnerability (CWE-502) in the Meta Tag Manager WordPress plugin by netweblogic. The flaw exists in the get_post_data function, allowing authenticated users with contributor or higher privileges to inject PHP objects. The plugin does not include a POP chain internally, but if other installed plugins or themes provide one, exploitation could lead to file deletion, sensitive data disclosure, or remote code execution. The vulnerability affects all versions up to and including 3.0.2 and has a CVSS 3.1 score of 8.8 (Network attack vector, low attack complexity, privileges required, no user interaction, high confidentiality, integrity, and availability impact). No patch or official fix information is currently provided.

An attacker with contributor-level access or higher can exploit this vulnerability to inject PHP objects via deserialization. Without a POP chain in the plugin itself, direct exploitation is limited, but if other plugins or themes provide a POP chain, the attacker could delete arbitrary files, retrieve sensitive information, or execute arbitrary code, leading to full compromise of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Meta Tag Manager plugin if possible. Monitor for updates from the vendor or security community regarding patches or mitigations.