CVE-2024-7560 is a deserialization of untrusted data vulnerability (CWE-502) in the News Flash WordPress theme by codename065, affecting all versions up to 1.1.0. The issue arises from unsafe deserialization of the newsflash_post_meta meta value, permitting PHP Object Injection by authenticated users with Editor or higher privileges. Although the theme does not include a known POP chain, exploitation potential increases if other installed plugins or themes provide such chains, potentially leading to arbitrary file deletion, sensitive data disclosure, or code execution. The vulnerability is remotely exploitable over the network with low attack complexity but requires elevated privileges.

Successful exploitation could lead to high-impact consequences including complete compromise of the affected WordPress site. Attackers with Editor-level access could inject PHP objects, which combined with additional gadget chains from other plugins or themes, may allow deletion of arbitrary files, disclosure of sensitive information, or remote code execution. This elevates the risk to confidentiality, integrity, and availability of the site and its data.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Editor-level access to trusted users only and consider disabling or replacing the News Flash theme if possible. Review installed plugins and themes for potential gadget chains that could facilitate exploitation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.