CVE-2024-13770 is a high severity (CVSS 8.1) PHP object injection in the Puzzles WP Magazine and Review theme for WordPress, in versions up to and including 4.2.4, through the view_more_posts AJAX action. Impact depends on other installed code. Update past 4.2.4.
What's affected
- Puzzles WP Magazine / Review with Store theme (ThemeREX), all versions up to and including 4.2.4.
The record does not name a fixed version. This theme is sold through a marketplace, so check the item page and changelog for a release newer than the last affected version.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp theme list --format=table | grep -i puzzles
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the theme to a release newer than 4.2.4.
- Review plugins and themes for components that could supply a gadget chain.
- If you cannot update, consider switching theme.
- Look up CVE-2024-13770 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record says the theme deserializes untrusted input in the view_more_posts AJAX action. AJAX endpoints in WordPress are reachable by anyone who can reach the site, unless the code adds its own checks. No known chain exists in the theme itself, so the severity depends on the rest of the site.
Deserializing a value from a request is rarely needed. Sending an ID or a JSON structure and rebuilding objects on the server avoids the problem.
This CVE is a PHP object injection flaw (CWE-502, Deserialization of Untrusted Data). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
PHP object injection comes from deserializing data that an outsider controls. When the application rebuilds an object from that data, it can trigger code in the class that was never meant to run for this input.
What happens next depends on what other code is installed. The advisory text says no known gadget chain exists in the vulnerable software itself, so on its own the impact is limited. If another plugin or theme on the same site supplies a usable chain, the result can range from deleting files to data theft to code execution. That makes your full plugin list part of the risk, not just the one component named here.
Quick check
Why is complexity high?
Impact depends on a gadget chain in another installed component.
Which AJAX action is affected?
view_more_posts.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
