CVE-2024-10932

The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.

• CWE-502

• https://plugins.trac.wordpress.org/browser//backup-backup/tags/1.4.6/includes/database/search-replace.php#L46
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.4.6.1/includes/database/search-replace.php#L46
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a0c514-5200-47f4-9d2e-684d68946b9a?source=cve

Published

Jan 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10926A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.…5.3
• CVE-2024-10927A vulnerability was found in MonoCMS up to 20240528. It has …6.1
• CVE-2024-10928A vulnerability was found in MonoCMS up to 20240528. It has …6.1
• CVE-2024-10929In certain circumstances, an issue in Arm Cortex-A57, Cortex…5.1
• CVE-2024-1093The Change Memory Limit plugin for WordPress is vulnerable t…5.3
• CVE-2024-10930An Uncontrolled Search Path Element vulnerability exists whi…7.8
• CVE-2024-10933In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before erra…5.5
• CVE-2024-10934In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before erra…9.8
• CVE-2024-10935automatic1111/stable-diffusion-webui version 1.10.0 contains…7.5
• CVE-2024-10936The String locator plugin for WordPress is vulnerable to PHP…8.8
• CVE-2024-10937The Related Posts, Inline Related Posts, Contextual Related …5.3
• CVE-2024-10938The OVRI Payment plugin for WordPress contains malicious .ht…6.5