PT-2025-1614 · WordPress · Backup Migration Plugin
Craig Smith
+1
·
Published
2025-01-04
·
Updated
2025-01-04
·
CVE-2024-10932
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Backup Migration plugin for WordPress versions up to, and including, 1.4.6
Description
The issue concerns a PHP Object Injection vulnerability via deserialization of untrusted input in the
recursive unserialize replace function. This allows unauthenticated attackers to inject a PHP Object, and with the presence of a POP chain, they can delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site to trigger the exploit.Recommendations
For Backup Migration plugin for WordPress versions up to, and including, 1.4.6, update to a version higher than 1.4.6 to resolve the issue. As a temporary workaround, consider disabling the
recursive unserialize replace function until a patch is available. Restrict access to sensitive data and files to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Backup Migration Plugin