CVE-2024-6152 is a deserialization of untrusted data vulnerability (CWE-502) in the Flipbox Builder plugin for WordPress, affecting all versions up to 1.5. The vulnerability arises from unsafe deserialization in the flipbox_builder_Flipbox_ShortCode function, allowing authenticated users with Contributor or higher privileges to inject PHP objects. While the plugin does not contain a known POP chain for exploitation, the presence of additional plugins or themes with gadget chains could enable attackers to perform critical actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

Successful exploitation requires authenticated access at Contributor level or above. Without a suitable POP chain from other installed components, exploitation is limited. However, if a POP chain is present, attackers could delete arbitrary files, access sensitive information, or execute arbitrary code, resulting in full compromise of the affected WordPress site.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory for updates. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Flipbox Builder plugin if possible. Review installed plugins and themes for potential POP chains that could be leveraged in exploitation.