CVE-2024-10932
Published: 04 January 2025
Description
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
Security Summary
CVE-2024-10932 is a PHP Object Injection vulnerability (CWE-502) in the Backup Migration plugin for WordPress, affecting all versions up to and including 1.4.6. The flaw stems from deserialization of untrusted input in the `recursive_unserialize_replace` function, enabling unauthenticated attackers to inject a PHP Object. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit the vulnerability by leveraging the PHP Object Injection in combination with a POP chain, potentially allowing them to delete arbitrary files, retrieve sensitive data, or execute arbitrary code. Exploitation requires user interaction, specifically an administrator creating a staging site to trigger the deserialization process.
Advisories, including Wordfence's threat intelligence report, provide further details on the vulnerability. Code references in the WordPress plugin trac repository highlight the issue at line 46 in `includes/database/search-replace.php` for versions 1.4.6 and 1.4.6.1.
Details
- CWE(s)