CVE-2024-10936: Instawp String Locator RCE Vulnerability

CVE-2024-10936 Overview

CVE-2024-10936 is a PHP Object Injection vulnerability affecting the String Locator plugin for WordPress in all versions up to and including 2.6.6. The flaw resides in the recursive_unserialize_replace function, which deserializes untrusted input without validation [CWE-502]. Unauthenticated attackers can inject arbitrary PHP objects through this entry point. While the plugin itself does not contain a Property-Oriented Programming (POP) chain, the presence of one in any other installed plugin or theme can escalate exploitation to arbitrary file deletion, sensitive data disclosure, or remote code execution. Exploitation requires an administrator to perform a search and replace action, which acts as the trigger.

Critical Impact
When chained with a POP gadget from another installed component, attackers can execute arbitrary code, delete files, or exfiltrate sensitive data from the WordPress instance.

Affected Products

Instawp String Locator plugin for WordPress, versions ≤ 2.6.6
WordPress sites with the plugin enabled and additional plugins or themes containing POP chains
All deployments where administrators may perform search and replace operations

Discovery Timeline

2025-01-21 - CVE-2024-10936 published to the National Vulnerability Database (NVD)
2025-02-05 - Last updated in NVD database

Technical Details for CVE-2024-10936

Vulnerability Analysis

The String Locator plugin provides administrators with the ability to search and replace text across WordPress database tables. During replacement operations, the plugin invokes the recursive_unserialize_replace function to walk serialized data structures stored in database fields.

This function calls PHP's unserialize() on attacker-influenced data without enforcing an allowed_classes constraint. When unserialize() processes a crafted serialized payload, PHP instantiates arbitrary classes and triggers magic methods such as __wakeup() or __destruct() on the resulting objects. This behavior is the classic prerequisite for PHP Object Injection.

The vulnerable code path is documented in the plugin source at includes/Extension/SearchReplace/Replace/class-sql.php. The fix was committed in WordPress plugin changeset 3222952.

Root Cause

The root cause is unsafe deserialization of untrusted input [CWE-502]. The recursive_unserialize_replace routine processes serialized PHP data from database cells that an unauthenticated user may have previously written, for example through comment forms, options, or other writable storage. No type checking, signature validation, or class whitelist is applied before the data is materialized into live PHP objects.

Attack Vector

An unauthenticated attacker first plants a serialized PHP object payload in a database field that the target site stores—commonly comment metadata, post meta, or user-controllable options. The payload remains dormant until an administrator runs a search and replace operation through the String Locator interface. When the plugin walks the affected row, unserialize() is invoked on the planted payload and PHP instantiates the attacker-chosen class. If any installed plugin or theme exposes a class with exploitable magic methods, the resulting POP chain executes attacker-controlled behavior in the WordPress process context.

No public proof-of-concept or exploit-database entry is currently listed for this issue, and it is not present on the CISA Known Exploited Vulnerabilities catalog. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-10936

Indicators of Compromise

Presence of String Locator plugin versions ≤ 2.6.6 reported by WordPress plugin inventory scans
Database cells containing serialized PHP object markers such as O: or C: followed by class names not used by any installed component
Unexpected file creation, deletion, or modification within wp-content/ following an administrator search and replace action
Outbound network connections from the PHP-FPM or web server process immediately after String Locator usage

Detection Strategies

Scan WordPress database backups for serialized payloads referencing class names from installed plugins that contain known POP gadgets
Hook PHP error logging to capture __wakeup, __destruct, or autoload activity during String Locator replace operations
Monitor web server logs for administrator sessions invoking the String Locator search and replace endpoints in the WordPress admin area
Cross-reference plugin version inventories against the fixed changeset 3222952 to identify unpatched installations

Monitoring Recommendations

Enable WordPress audit logging for plugin activation, plugin updates, and any execution of String Locator search and replace jobs
Forward web server, PHP, and WordPress logs to a centralized analytics platform for correlation across administrator actions and downstream file or process events
Alert on new PHP file writes inside wp-content/uploads/ or wp-content/plugins/ that follow administrator activity in the String Locator UI

How to Mitigate CVE-2024-10936

Immediate Actions Required

Upgrade the String Locator plugin to a version newer than 2.6.6 that includes WordPress changeset 3222952
Audit all installed plugins and themes for classes containing dangerous __wakeup, __destruct, or __toString methods that could form a POP chain
Restrict administrator access to the String Locator search and replace functionality until patching is complete
Review database content for unexpected serialized objects in user-writable tables such as wp_comments, wp_postmeta, and wp_options

Patch Information

The vendor addressed the vulnerability in WordPress plugin changeset 3222952. The fix removes unsafe deserialization in the recursive_unserialize_replace code path within includes/Extension/SearchReplace/Replace/class-sql.php. Site administrators should update through the WordPress plugin updater or replace the plugin files manually using the WordPress Changeset #3222952.

Workarounds

Deactivate and remove the String Locator plugin from any site that cannot immediately upgrade to a patched version
Avoid running search and replace operations on tables containing unsanitized user input until the plugin is updated
Apply web application firewall rules that block requests containing serialized PHP object markers targeting WordPress admin endpoints
Remove unused plugins and themes from the site to shrink the available POP gadget surface

bash

# Configuration example: identify vulnerable installations via WP-CLI
wp plugin list --name=string-locator --fields=name,status,version

# Force update to the patched release
wp plugin update string-locator