PT-2025-11168 · WordPress · All-In-One Wp Migration/Backup

Craig Smith + 1 · Published 2025-03-13 · Updated 2025-03-18 · CVE-2024-10942

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration and Backup plugin for WordPress versions up to, and including, 7.89

Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in the replace serialized values function. If a POP chain is present, possibly through an additional plugin or theme, it could enable the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The exploit can be triggered by an administrator exporting and restoring a backup.

Recommendations: For versions up to, and including, 7.89, update to a version that fixes the PHP Object Injection issue to prevent exploitation. As a temporary workaround, consider restricting access to the replace serialized values function until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-10942

Affected Products

All-In-One Wp Migration/Backup

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-10942 · Security Note
• https://twitter.com/vulns_space/status/1900184245009539357 · Twitter Post
• https://t.me/cvetracker/19041 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0823d1d9-4f3b-4ac0-8cd1-ad208ebc325f?source=cve · Note
• https://t.me/cvedetector/20211 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3253940 · Note
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/trunk/lib/vendor/servmask/database/class-ai1wm-database-utility.php#L97 · Note
• https://twitter.com/cracbot/status/1901951798044459096 · Twitter Post