PHP Object Injection Vulnerability in All-in-One WP Migration and Backup Plugin for WordPress

CVE-2024-10942

What is CVE-2024-10942?

The All-in-One WP Migration and Backup plugin for WordPress contains a vulnerability that allows for PHP Object Injection through the deserialization of untrusted input in the 'replace_serialized_values' function across all versions up to and including 7.89. This can enable unauthenticated attackers to exploit the plugin, potentially leading to unauthorized file deletions, data retrieval, or even remote code execution if exploited via an existing plugin or theme that presents a PHP Object Payload (POP) chain. An exploitation scenario necessitates that an administrator performs an export and restore operation, creating an opportunity for the attacker.

References