CVE-2024-3954 is a PHP Object Injection vulnerability in the Ditty – Responsive News Tickers, Sliders, and Lists WordPress plugin, affecting all versions up to 3.1.38. It arises from unsafe deserialization of untrusted input when adding new ditties, allowing authenticated users with contributor-level privileges or higher to inject PHP objects. The plugin itself lacks a known POP chain, but exploitation could be enabled if additional plugins or themes installed on the target system provide such chains, potentially leading to arbitrary file deletion, sensitive data disclosure, or code execution.

Successful exploitation requires authenticated access with contributor-level permissions or higher. The impact includes potential full compromise of the affected WordPress site if a POP chain is available via other installed components. This can lead to high confidentiality, integrity, and availability impacts, including arbitrary code execution, data theft, and file deletion. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Ditty plugin if not essential. Monitor for updates from the vendor or security advisories for a patch or official mitigation.