CVE-2024-10942

Summary

CVE-2024-10942 is a vulnerability affecting the All-in-One WP Migration and Backup plugin for WordPress. The issue lies in the 'replace_serialized_values' function, where untrusted input is deserialized, making it possible for unauthenticated attackers to inject a PHP Object. No Pop chain is known to be present in the vulnerable software, but if one exists through an additional plugin or theme, the attacker could delete files, retrieve sensitive data, or execute arbitrary code. An administrator must import and restore a backup to trigger the exploit.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.