CVE-2024-56059 CRITICAL

CVE-2024-56059: WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability

Vendor Farinspace
Product Partners
Weakness CWE-1321
Published December 18, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.

Explanation of Vulnerability in Simple Terms

02Summary

A critical vulnerability in farinspace Partners versions 0.2.0 and earlier allows unauthenticated attackers to read sensitive data, modify content, or disrupt service over the network. No user interaction is required. The vulnerability stems from an unknown weakness in the application's security controls. Immediate patching is essential.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt service without authentication.

Potential impact on your site

04Site Impact

Attackers can access, modify, or delete data and disrupt service availability without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

December 18, 2024 CVE published
April 28, 2026 Record updated