CVE-2024-1895 is a PHP Object Injection vulnerability (CWE-502) in the Event Monster – Manager & Ticket Booking WordPress plugin by awordpresslife. The flaw exists in all versions up to and including 1.3.9, where untrusted input from a custom meta value is deserialized via shortcode without proper validation. Authenticated attackers with contributor or higher privileges can exploit this to inject PHP objects. Although the vulnerable plugin does not contain a POP chain, exploitation potential increases if other installed plugins or themes provide such chains, potentially leading to file deletion, data disclosure, or code execution. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation allows authenticated users with contributor or higher privileges to inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or remote code execution if a POP chain is present in other installed components. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site.

No official patch or fix is currently available for this vulnerability. Administrators should restrict contributor-level access and above to trusted users only and monitor for suspicious activity. Review installed plugins and themes for potential POP chains that could be leveraged in conjunction with this vulnerability. Check the vendor advisory or plugin updates regularly for any forthcoming patches or mitigations.