CVE-2024-8514 is a critical PHP Object Injection vulnerability in the Prisna GWT – Google Website Translator WordPress plugin up to version 1.4.11. It arises from unsafe deserialization of untrusted data passed via the 'prisna_import' parameter. Exploitation requires authenticated users with Administrator-level access or higher. Although the plugin does not include a known POP chain internally, exploitation could be possible if other installed plugins or themes provide such chains, potentially allowing attackers to delete files, access sensitive information, or execute arbitrary code.

An attacker with Administrator privileges can inject PHP objects through the vulnerable deserialization process. Without a known POP chain in the plugin, direct exploitation is limited, but if additional plugins or themes with exploitable POP chains are present, the attacker could achieve critical impacts including arbitrary code execution, data theft, or file deletion. The vulnerability is rated critical with a CVSS score of 9.1, reflecting high confidentiality, integrity, and availability impacts.

No patch or official fix is currently available for this vulnerability. Since exploitation requires Administrator-level access, limiting administrative privileges and monitoring for suspicious activity is recommended. Users should check the vendor's advisory or plugin updates regularly for any forthcoming patches. Additionally, review and harden other installed plugins and themes to reduce the risk of POP chain exploitation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.