// For flags

CVE-2024-3054

WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

El complemento WPvivid Backup &amp; Migration para WordPress es vulnerable a la deserialización PHAR en todas las versiones hasta la 0.9.99 incluida a través de la deserialización de entradas que no son de confianza en la acción wpvividstg_get_custom_exclude_path_free. Esto se debe a que el complemento no proporciona suficiente validación de ruta en el parámetro tree_node[nodo][id]. Esto hace posible que atacantes autenticados, con acceso de nivel de administrador y superior, llamen archivos usando un contenedor PHAR que deserializará los datos y llamará objetos PHP arbitrarios. No hay ninguna cadena POP presente en el complemento vulnerable. Si hay una cadena POP presente a través de un complemento o tema adicional instalado en el sistema de destino, podría permitir al atacante eliminar archivos arbitrarios, recuperar datos confidenciales o ejecutar código.

*Credits: Maksim Kosenko
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-03-28 CVE Reserved
  • 2024-04-11 CVE Published
  • 2024-08-01 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wpvividplugins
Search vendor "Wpvividplugins"
 Migration, Backup, Staging – WPvivid
Search vendor "Wpvividplugins" for product "Migration, Backup, Staging – WPvivid"
 <= 0.9.99
Search vendor "Wpvividplugins" for product "Migration, Backup, Staging – WPvivid" and version " <= 0.9.99"
en
Affected