CVE-2024-0825 is a high severity (CVSS 8.8) PHP object injection in the Vimeography Vimeo Video Gallery plugin for WordPress, in all versions up to 2.3.2. Authenticated users with contributor access or higher can reach it. Update to a version later than 2.3.2 and review contributor accounts.
What's affected
The Vimeography: Vimeo Video Gallery plugin for WordPress, all versions up to and including 2.3.2. The record says deserialization of untrusted input in the duplicate_gallery function, through the vimeography_duplicate_gallery_serialized value, lets authenticated attackers with contributor access or higher inject a PHP object.
The record states that no POP chain exists in the plugin itself. If another plugin or theme provides one, the result could be deleting arbitrary files, reading sensitive data or running code. No fixed version is named, so check the plugin changelog.
The record classifies the weakness as CWE-502 (deserialization of untrusted data). NVD scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Plugins are the usual blind spot on a WordPress estate, so start with an inventory. If you have shell access and WP-CLI, this lists every plugin with its version and status:
wp plugin list --fields=name,status,version,update
Look for Vimeography in the output and compare the version to the range above. Without WP-CLI, open Plugins in the dashboard and read the version under the plugin name. Do this on every site, including staging copies and old multisite installs, because inactive plugins still sit on disk and some can be reached directly by URL.
The free in-browser dependency scan covers application dependencies in your repositories. It does not read a live WordPress install, so use the plugin list for this one.
What to do now
- Update Vimeography to a version later than 2.3.2.
- Review accounts with the contributor role or higher, and remove those you do not need.
- Audit your other plugins and themes. Remove ones you no longer use, since each can supply a POP chain.
- Take a backup before updating.
Why it matters
Deserialization of untrusted data (CWE-502) lets input decide which objects a program rebuilds. Without a usable chain of existing classes the injection does little, which is why the record stresses that none is present in this plugin.
That is also why the risk is site specific. The same flaw is harmless on a lean site and serious on one with many plugins.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
Whether a flaw is practically exploitable depends on context, such as a POP chain here. This demo shows how an exploitability check adds that context to a finding.
Click through it at your own pace, or open it full screen.
Quick check
Is my site at risk if nothing else is installed?
The record says no POP chain exists in the plugin alone, so the direct impact is limited, but update anyway because you cannot know what you add later.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
- www.wordfence.com
- Safeguard Gold entry for CVE-2024-0825
Last reviewed: 19 October 2026.
