CVE-2024-2006 is a PHP Object Injection vulnerability in the WordPress plugin 'Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget' up to version 1.6.7. The issue arises from unsafe deserialization of untrusted input in the outpost_shortcode_metabox_markup function. Attackers with at least contributor-level privileges can inject crafted PHP objects. Exploitation depends on the presence of a gadget chain (POP chain) from other plugins or themes, potentially enabling file deletion, data leakage, or code execution. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8.

Successful exploitation allows authenticated users with contributor or higher privileges to perform PHP Object Injection, which can lead to arbitrary file deletion, sensitive information disclosure, or remote code execution if a suitable POP chain is present. This compromises confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for updates from the plugin vendor. Avoid installing untrusted plugins or themes that could provide POP chains enabling exploitation.