CVE-2024-10957
Published: 04 January 2025
Summary
CVE-2024-10957 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-10957 is a PHP Object Injection vulnerability (CWE-502) affecting the UpdraftPlus: WP Backup & Migration Plugin for WordPress in versions 1.23.8 through 1.24.11. The issue stems from deserialization of untrusted input within the 'recursive_unserialized_replace' function, enabling unauthenticated attackers to inject a PHP object. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability only if an administrator performs a search and replace action, which triggers the deserialization process. The plugin itself contains no known Property-Oriented Programming (POP) chain, rendering it ineffective in isolation. However, if another plugin or theme on the target site provides a POP chain, exploitation could allow arbitrary file deletion, sensitive data retrieval, or code execution, depending on the capabilities of that chain.
Advisories point to mitigation via patching, as evidenced by the fix in changeset 3212299 at https://plugins.trac.wordpress.org/changeset/3212299/. The vulnerable code is located in class-search-replace.php at line 411 (https://plugins.trac.wordpress.org/browser/updraftplus/trunk/includes/class-search-replace.php#L411), and further details are available in the Wordfence threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/4729ed37-96b2-4717-8a72-89b9a21ec058?source=cve).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33351
Vulnerability details
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to…
more
inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection in public-facing WP plugin enables exploitation of remote services/application for code exec or impact when triggered.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation ensures patching of the UpdraftPlus plugin to fix the unsafe deserialization in recursive_unserialized_replace.
Information input validation prevents deserialization of untrusted data carrying malicious PHP objects in the search-replace function.
Controls on user-installed software restrict deployment of vulnerable third-party WordPress plugins like UpdraftPlus.