CVE-2024-3054 WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization
Authenticated admins can exploit PHAR deserialization to execute code or access data if a POP chain exists in other installed plugins or themes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3054?
CVE-2024-3054 is a high-severity unsafe deserialization vulnerability in wpvividplugins WPvivid — Backup, Migration & Staging, published on 12 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Weakness: CWE-502
Which versions are affected by CVE-2024-3054?
It affects 1 product.
Products include Wpvivid Migration\, Backup\, Staging.
How do I fix CVE-2024-3054?
No fix has been published for CVE-2024-3054 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-3054 being exploited?
There is no known exploitation of CVE-2024-3054 in the wild and no public exploit code.
Other vulnerabilities in wpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2024-1981 SQL injection in Migration, Backup, Staging – WPvivid
- CVE-2024-10962 Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection
- CVE-2020-36842 Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2023-41243 WordPress WPvivid Backup Plugin plugin <= 0.9.90 - Privilege Escalation on Staging Environment vulnerability
- CVE-2023-4274 Path traversal in Migration, Backup, Staging – WPvivid
Sources
Also known as GHSA-p695-j8cg-jq46.