CVE-2024-0668 is a medium severity php object injection flaw in Advanced Database Cleaner WordPress Plugin, scored CVSS 6.6. The record lists all versions up to and including 3.1.3. Update to a release newer than 3.1.3. Read the checks below to find out whether you run an affected build.
What's affected
The record lists all versions up to and including 3.1.3. The process_bulk_action function deserializes untrusted input, and the attacker needs administrator access. No POP chain is present in the plugin itself.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, with a base score of 6.6 (Medium). KEV status: not listed in the record.
Fixed version: Update to a release newer than 3.1.3. The Wordfence page I fetched gave no version numbers, so confirm the exact fixed release in the plugin changelog.
How to check if you're exposed
From the WordPress server, list the installed version with WP-CLI.
wp plugin list --name=advanced-database-cleaner --fields=name,status,version
You can also open Plugins in the admin dashboard. Any version at or below the one named in the record needs an update. You can also run a free in-browser dependency scan on project manifests to catch libraries that carry this CVE.
What to do now
- Back up the site, then update the plugin to the fixed release.
- Review administrator and subscriber accounts and remove ones you do not recognise.
- Check database and web logs for unusual requests to the plugin endpoints.
- Rescan your dependencies and plugins after the update to confirm the finding closes.
Why it matters
CWE-502 describes this class. Deserialization of untrusted data means the application rebuilds objects from input that an outsider can influence. Depending on which classes are available, that can lead to unexpected behaviour or code execution. Avoid deserializing untrusted input, and prefer plain data formats such as JSON where possible.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-02-05.
For a wider view, a free in-browser dependency scan and the Gold directory show where Advanced Database Cleaner WordPress Plugin sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0668 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Do I need to remove the plugin?
Not if a fixed release is available. Update, and remove the plugin if you no longer use it.
Sources
- Wordfence entry (page gave no version numbers)
- Safeguard Gold entry for CVE-2024-0668
- NVD record data for CVE-2024-0668.
Last reviewed: 19 October 2026.
