CVE-2024-10932

Summary

CVE-2024-10932 is a vulnerability affecting the Backup Migration plugin for WordPress. In versions up to 1.4.6, unauthenticated attackers can exploit the 'recursive_unserialize_replace' function, which is susceptible to PHP Object Injection via deserialization of untrusted input. This vulnerability allows for the injection of a PHP Object and, in combination with a POP chain, results in potential file deletion, data retrieval, or code execution. WordPress administrators are advised to create a staging site to mitigate this risk and apply the necessary patch.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.