CVE-2024-13889

The WordPress Importer plugin through version 0.8.3 allows authenticated administrators to inject arbitrary PHP objects through unsafe deserialization in the 'maybe_unserialize' function. While the plugin itself lacks a gadget chain to exploit this vulnerability, the presence of a suitable gadget chain in another installed plugin or theme could enable attackers to delete files, access sensitive information, or execute arbitrary code. This vulnerability was fixed in version 0.8.4.

Based on public CVE data (MITRE/NVD).