CVE-2024-1896 is a PHP Object Injection vulnerability in the awordpresslife Photo Gallery for Images WordPress plugin. It arises from unsafe deserialization of untrusted input passed through the 'awl_lg_settings_' shortcode attribute. Authenticated users with contributor or higher privileges can exploit this to inject PHP objects. While the vulnerable plugin does not include a POP chain, exploitation potential increases if other installed plugins or themes provide one, enabling severe impacts such as arbitrary file deletion, data leakage, or code execution. The CVSS v3.1 base score is 7.5, reflecting high impact but requiring authenticated access and high attack complexity.

Successful exploitation allows authenticated contributors or higher to inject PHP objects via deserialization, potentially leading to arbitrary file deletion, sensitive data exposure, or remote code execution if a suitable POP chain exists in the environment. This can compromise confidentiality, integrity, and availability of the affected WordPress site.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Review installed plugins and themes for potential POP chains that could be leveraged in combination with this vulnerability.