CVE-2024-9511 is a critical deserialization vulnerability (CWE-502) in the FluentSMTP – WP SMTP Plugin for WordPress, affecting all versions up to and including 2.2.82. The vulnerability arises from unsafe deserialization in the 'formatResult' function, enabling unauthenticated PHP Object Injection. Although the plugin itself does not contain a gadget chain for exploitation, the presence of other plugins or themes with suitable POP chains could allow attackers to perform destructive or unauthorized actions such as deleting files, accessing sensitive information, or executing arbitrary code. The vulnerability was partially addressed in version 2.2.82, but users running earlier versions remain at risk.

Successful exploitation can lead to remote code execution, data disclosure, and arbitrary file deletion due to PHP Object Injection via deserialization of untrusted data. The impact is critical as it requires no authentication and has network attack vector with low complexity. However, exploitation depends on the presence of a gadget chain in other installed components, which is not present in the plugin itself.

A partial patch was introduced in version 2.2.82 of the FluentSMTP plugin. Users should update to version 2.2.82 or later to mitigate this vulnerability. Since the patch is partial, monitoring vendor advisories for further updates is recommended. No official full fix or complete remediation details are provided in the available data. Patch status is not yet fully confirmed—check the vendor advisory for current remediation guidance.