CVE-2024-10932
Published: 04 January 2025
Summary
CVE-2024-10932 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-10932 is a PHP Object Injection vulnerability (CWE-502) in the Backup Migration plugin for WordPress, affecting all versions up to and including 1.4.6. The flaw stems from deserialization of untrusted input in the `recursive_unserialize_replace` function, enabling unauthenticated attackers to inject a PHP Object. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit the vulnerability by leveraging the PHP Object Injection in combination with a POP chain, potentially allowing them to delete arbitrary files, retrieve sensitive data, or execute arbitrary code. Exploitation requires user interaction, specifically an administrator creating a staging site to trigger the deserialization process.
Advisories, including Wordfence's threat intelligence report, provide further details on the vulnerability. Code references in the WordPress plugin trac repository highlight the issue at line 46 in `includes/database/search-replace.php` for versions 1.4.6 and 1.4.6.1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33404
Vulnerability details
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP…
more
Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via unauthenticated exploitation of a public-facing WordPress plugin vulnerability (PHP object injection).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2024-10932 by requiring timely patching of the vulnerable Backup Migration plugin to eliminate the unsafe deserialization in recursive_unserialize_replace.
Prevents PHP Object Injection by enforcing validation of untrusted serialized input prior to deserialization processing in the plugin.
Identifies the PHP Object Injection vulnerability in the WordPress Backup Migration plugin through automated vulnerability scanning.