Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

VEDA WordPress Theme Allows Malicious Code to Run on Your Site

CVE-2024-13787 · published 1 year ago
Summary

The VEDA WordPress Theme is vulnerable to a security flaw that could allow an attacker to run malicious code on your site, if you have certain other plugins or themes installed. This vulnerability only affects versions 4.2 and earlier. To fix this, update to a newer version of the theme or remove any plugins that might be exploited by an attacker.

Original advisory text
The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'veda_backu...
The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'veda_backup_and_restore_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published5 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-13787 · NVD
Track software like this
Free during beta