CVE-2021-24217: facebook Deserialization of Untrusted Data
Vulnerability summary
CVE-2021-24217 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in facebook. EPSS estimates a 3.52% chance of exploitation in the next 30 days, higher than 89% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 3.0.0.
Timeline
- 12-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.52%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.52% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Facebook1 product
- facebook< 3.0.0
Unknown1 product
- facebook for wordpress≥ 3.0.0, < 3.0.0
Wordpress1 product
- official-facebook-pixel≤ 2.2.2 (fixed in 3.0.0)
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/509f2754-a1a1-4142-9126-ae023a88533aX Refsource CONFIRMExploitThird Party Advisory
- www.wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin/X Refsource MISCExploitThird Party Advisory