PHP Object Injection Vulnerability in WPvivid Plugin for WordPress

CVE-2024-10962

What is CVE-2024-10962?

The WPvivid Backup and Staging plugin for WordPress is susceptible to PHP Object Injection due to flawed deserialization of untrusted input in the 'replace_row_data' and 'replace_serialize_data' functions. This vulnerability enables unauthenticated attackers to manipulate PHP objects, posing a significant risk, especially if coupled with another plugin or theme that creates a potential PHP Object Pop chain. Exploitation of this vulnerability allows attackers to execute arbitrary code, delete files, or access sensitive information. To trigger this exploit, an administrator must establish a staging site, highlighting the necessity for prompt updates and rigorous security practices for users of the plugin.

References