CVE-2024-4733 is a PHP Object Injection vulnerability in the ShiftController Employee Shift Scheduling WordPress plugin, affecting versions up to and including 4.9.57. The vulnerability arises from unsafe deserialization of the hc3_session cookie, allowing an authenticated user with contributor or higher privileges to inject PHP objects. The plugin itself lacks a gadget chain for exploitation, but if other plugins or themes installed on the target system provide such chains, attackers could exploit this to delete arbitrary files, retrieve sensitive information, or execute code. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity.

An authenticated attacker with contributor-level access or higher can inject PHP objects via the vulnerable deserialization process. Without a gadget chain in the plugin itself, exploitation depends on the presence of additional vulnerable plugins or themes. Successful exploitation could lead to arbitrary file deletion, sensitive data disclosure, or remote code execution, impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the ShiftController Employee Shift Scheduling plugin if possible. Monitor for updates from the vendor or security advisories for a patch or official mitigation instructions.