CVE-2024-10932CWE-502

Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'

High · published January 4, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-01-04T07:24Z
EPSS history
Timeline
  • 04 JAN 07:24Z
    Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'
    cvelistv5