CVE-2024-1872 is a deserialization vulnerability (CWE-502) in the burgersoftware Button WordPress plugin affecting all versions up to 1.1.27. The flaw arises from unsafe deserialization of untrusted input in the button_shortcode function, enabling authenticated users with contributor or higher privileges to inject PHP objects. While the plugin itself lacks a known POP chain for exploitation, the presence of additional plugins or themes with POP chains could enable severe impacts such as arbitrary file deletion, sensitive data disclosure, or remote code execution. The vulnerability is rated high severity with a CVSS score of 8.8. No patch or remediation guidance is currently available from the vendor or public advisories.

Successful exploitation requires authenticated access with contributor-level permissions or higher. Without a POP chain in the plugin, direct exploitation is limited; however, if combined with other vulnerable components, attackers could achieve high-impact outcomes including full system compromise, data theft, or destruction of files. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for updates from burgersoftware. Consider disabling or removing the Button plugin if not essential, or applying custom code-level mitigations to prevent unsafe deserialization if feasible.