CVE-2024-2290 is a PHP Object Injection vulnerability in the monetizemore Advanced Ads – Ad Manager & AdSense WordPress plugin affecting all versions up to 1.52.1. The flaw arises from unsafe deserialization of untrusted input via the 'placement_slug' parameter. Although the plugin does not include a POP (Property Oriented Programming) chain itself, exploitation is possible if other installed plugins or themes provide such chains, potentially leading to arbitrary file deletion, data disclosure, or code execution. The vulnerability requires authenticated access and has a CVSS 3.1 score of 7.2, indicating high severity.

Successful exploitation can lead to high-impact consequences including confidentiality, integrity, and availability breaches. Specifically, attackers with authenticated access could leverage this vulnerability combined with other gadget chains to delete arbitrary files, retrieve sensitive information, or execute arbitrary code on the affected WordPress site.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and review installed plugins and themes for potential gadget chains that could be exploited in conjunction with this vulnerability. Consider disabling or removing the Advanced Ads plugin if feasible.