CVE-2024-34433 MEDIUM

CVE-2024-34433: WordPress One Click Demo Import plugin <=3.2.0 - PHP Object Injection vulnerability

Vendor Ocdi

Product One Click Demo Import

Weakness CWE-502 · Unsafe deserialization

Published May 9, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.4/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in OCDI One Click Demo Import.This issue affects One Click Demo Import: from n/a through 3.2.0.

Explanation of Vulnerability in Simple Terms

02Summary

One Click Demo Import versions up to 3.2.0 contain a deserialization vulnerability that allows high-privilege users to trigger unintended code execution by supplying malicious serialized data. The attack requires administrator-level access and high attack complexity. Impact is limited to confidentiality and integrity of the affected system.

What an attacker can do

03Attacker Capabilities

An admin user can supply malicious serialized data to read sensitive information or modify site data.

Potential impact on your site

04Site Impact

If a compromised or malicious admin account exists, the site's data confidentiality and integrity are at risk.

Conditions required to exploit

05Prerequisites

Attacker must have administrator privileges and craft a specially formatted request with malicious serialized objects.

Key dates

06Disclosure timeline

May 9, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-34433 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities