CVE-2024-1770

The Meta Tag Manager plugin for WordPress contains a PHP Object Injection vulnerability in versions 3.0.2 and earlier through unsafe deserialization of user-supplied data in the get_post_data function. Authenticated users with at least contributor-level permissions can exploit this flaw to inject malicious PHP objects. While the plugin itself lacks a gadget chain to enable direct exploitation, the vulnerability could become dangerous if other installed plugins or themes contain exploitable chains, potentially allowing attackers to execute arbitrary code, access sensitive information, or delete files.

Based on public CVE data (MITRE/NVD).