CVE-2024-13824 is a critical (CVSS 9.8) PHP object injection in the CiyaShop multipurpose WooCommerce theme for WordPress, in versions up to and including 4.19.0, via the wishlist and compare functions. Impact depends on other installed code. Update past 4.19.0. Confirm the fixed release on the theme's item page.
What's affected
- CiyaShop, Multipurpose WooCommerce Theme, all versions up to and including 4.19.0.
- The affected functions are add_ciyashop_wishlist and ciyashop_get_compare.
The record does not name a fixed version. The theme changelog on its ThemeForest page is the place to confirm the release.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp theme list --format=table | grep -i ciyashop
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update the theme to a release newer than 4.19.0.
- Audit the site for plugins that could supply a gadget chain.
- Review recent file changes and new administrator accounts.
- Look up CVE-2024-13824 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
Unlike most object injection records here, this one is scored critical, because the CVSS vector sets attack complexity to low. The wishlist and compare features are storefront functions, and the record says they deserialize untrusted input.
The record still says no known chain exists in the theme itself. A critical score with no built-in chain means the true risk is set by the rest of your plugins, so that is where to start.
This CVE is a PHP object injection flaw (CWE-502, Deserialization of Untrusted Data). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
PHP object injection comes from deserializing data that an outsider controls. When the application rebuilds an object from that data, it can trigger code in the class that was never meant to run for this input.
What happens next depends on what other code is installed. The advisory text says no known gadget chain exists in the vulnerable software itself, so on its own the impact is limited. If another plugin or theme on the same site supplies a usable chain, the result can range from deleting files to data theft to code execution. That makes your full plugin list part of the risk, not just the one component named here.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is this critical when others are high?
The vector rates attack complexity as low here.
Does the attacker need an account?
No. The record says unauthenticated attackers can exploit it.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
