CVE-2024-3054

WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3067224%40wpvivid-backuprestore&new=3067224%40wpvivid-backuprestore&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bf26fc68-9fd4-4e4e-b34f-c947d95891f9?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3067224%40wpvivid-backuprestore&new=3067224%40wpvivid-backuprestore&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bf26fc68-9fd4-4e4e-b34f-c947d95891f9?source=cveThird Party Advisory

Published

Apr 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30534Missing Authorization vulnerability in typps Calendarista Ba…9.8
• CVE-2024-30535Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2024-30536Cross-Site Request Forgery (CSRF) vulnerability in WPFactory…4.3
• CVE-2024-30537Missing Authorization vulnerability in WPClever WPC Badge Ma…8.8
• CVE-2024-30538Missing Authorization vulnerability in DELUCKS GmbH DELUCKS …9.8
• CVE-2024-30539Missing Authorization vulnerability in Awesome Support Team …9.8
• CVE-2024-30540Guessable CAPTCHA vulnerability in Guido VS Contact Form all…5.3
• CVE-2024-30541Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS O…4.3
• CVE-2024-30542Improper Privilege Management vulnerability in Wholesale Who…9.8
• CVE-2024-30543Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2024-30544Missing Authorization vulnerability in UPQODE Whizzy.This is…9.8
• CVE-2024-30545Cross-Site Request Forgery (CSRF) vulnerability in Nick Powe…7.1