CVE-2022-2442

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1747Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1783Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.php&new=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.phpPatch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e2ca2e-c495-47f8-9c18-da5ba73d9e70?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2442Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1747Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1783Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.php&new=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.phpPatch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e2ca2e-c495-47f8-9c18-da5ba73d9e70?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2442Third Party Advisory

Published

Sep 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24414Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Toke…6.5
• CVE-2022-24415Dell BIOS contains an improper input validation vulnerabilit…7.8
• CVE-2022-24416Dell BIOS contains an improper input validation vulnerabilit…7.8
• CVE-2022-24417Dell BIOS contains an improper input validation vulnerabilit…6.7
• CVE-2022-24418Dell BIOS contains an improper input validation vulnerabilit…6.7
• CVE-2022-24419Dell BIOS contains an improper input validation vulnerabilit…7.8
• CVE-2022-24420Dell BIOS contains an improper input validation vulnerabilit…7.8
• CVE-2022-24421Dell BIOS contains an improper input validation vulnerabilit…7.8
• CVE-2022-24422Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.…9.8
• CVE-2022-24423Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of…7.5
• CVE-2022-24424Dell EMC AppSync versions from 3.9 to 4.3 contain a path tra…7.5
• CVE-2022-24425Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…