PHP Object Injection Vulnerability in All-in-One WP Migration and Backup Plugin for WordPress

CVE-2024-10942

What is CVE-2024-10942?

The All-in-One WP Migration and Backup plugin for WordPress contains a vulnerability that allows for PHP Object Injection through the deserialization of untrusted input in the 'replace_serialized_values' function across all versions up to and including 7.89. This can enable unauthenticated attackers to exploit the plugin, potentially leading to unauthorized file deletions, data retrieval, or even remote code execution if exploited via an existing plugin or theme that presents a PHP Object Payload (POP) chain. An exploitation scenario necessitates that an administrator performs an export and restore operation, creating an opportunity for the attacker.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References