CVE-2024-10957 Overview
CVE-2024-10957 affects the UpdraftPlus: WP Backup & Migration Plugin for WordPress. The vulnerability allows unauthenticated attackers to inject arbitrary PHP objects through deserialization of untrusted input in the recursive_unserialized_replace function. Versions from 1.23.8 through 1.24.11 are affected. The flaw is classified as Insecure Deserialization [CWE-502].
The vulnerability requires an administrator to perform a search and replace action to trigger exploitation. No Property-Oriented Programming (POP) chain exists in UpdraftPlus itself. However, if another installed plugin or theme contains a usable POP chain, attackers can chain it to delete files, exfiltrate data, or execute code.
Critical Impact
Unauthenticated attackers can inject PHP objects that, when combined with a POP chain from another installed plugin or theme, enable arbitrary file deletion, sensitive data disclosure, or remote code execution on the WordPress host.
Affected Products
- UpdraftPlus: WP Backup & Migration Plugin for WordPress version 1.23.8
- UpdraftPlus: WP Backup & Migration Plugin for WordPress versions 1.23.9 through 1.24.10
- UpdraftPlus: WP Backup & Migration Plugin for WordPress version 1.24.11
Discovery Timeline
- 2025-01-04 - CVE-2024-10957 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10957
Vulnerability Analysis
The vulnerability resides in the recursive_unserialized_replace function within includes/class-search-replace.php of UpdraftPlus. This function recursively walks through database content during a search and replace operation. It calls PHP's unserialize() on attacker-controllable input without validating that the serialized payload is safe.
When unserialize() processes a crafted string, PHP reconstructs object instances and invokes magic methods such as __wakeup() or __destruct() on those objects. If an attacker controls the class name and properties, they can instantiate any class loaded in the WordPress runtime. The vulnerability becomes weaponizable when a separate plugin or theme defines a class whose magic methods perform sensitive operations, forming a POP chain.
Exploitation requires user interaction. An administrator must initiate the search and replace action, which then processes the attacker-supplied serialized data. The plugin does not gate the affected code path with a serialization safety check.
Root Cause
The root cause is the use of native PHP unserialize() on data that can originate from untrusted sources without integrity verification or allow-listing of permitted classes. Safer alternatives such as unserialize($data, ['allowed_classes' => false]) or JSON-based serialization were not used. See the WordPress UpdraftPlus Code Review for the affected source.
Attack Vector
The attack is delivered over the network. An unauthenticated attacker plants a crafted serialized PHP object in a location that the plugin will process during a search and replace, such as a database field reachable via another input vector. When an administrator runs the search and replace, the plugin deserializes the payload and instantiates the attacker-defined object graph. If a POP chain is present, the gadget chain executes during deserialization. The patched code is available in WordPress Changeset #3212299.
No verified public exploit code is available. Refer to the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2024-10957
Indicators of Compromise
- Presence of UpdraftPlus versions between 1.23.8 and 1.24.11 on a WordPress installation.
- Database rows or option values containing serialized PHP payloads with unexpected class names such as O: prefixes referencing classes outside core WordPress or UpdraftPlus.
- Web server logs showing requests to UpdraftPlus search and replace endpoints followed by anomalous file system writes, deletions, or outbound network calls.
- New or modified PHP files under wp-content/ shortly after a search and replace action.
Detection Strategies
- Scan the WordPress database for serialized object markers (O:\d+:") in fields processed by UpdraftPlus search and replace operations.
- Monitor administrator session activity for search and replace invocations and correlate with subsequent process execution or file modification events on the host.
- Inventory installed plugins and themes for known POP gadget chains that increase exploitability.
Monitoring Recommendations
- Enable PHP error logging and review unserialize() warnings that reference unknown classes.
- Forward WordPress and web server logs to a centralized analytics platform for correlation across administrator actions and host-level events.
- Alert on unexpected outbound connections or file modifications originating from the PHP worker process after backup or migration operations.
How to Mitigate CVE-2024-10957
Immediate Actions Required
- Update UpdraftPlus to a version newer than 1.24.11 that contains the fix from WordPress Changeset #3212299.
- Audit installed plugins and themes and remove any unmaintained components that may contain POP gadget chains.
- Restrict administrator accounts to trusted personnel and require multi-factor authentication on wp-admin.
- Review database tables for unexpected serialized object payloads before executing any search and replace operation.
Patch Information
The vendor addressed the issue in the changeset referenced above. The fix modifies the recursive_unserialized_replace function to prevent instantiation of arbitrary classes during deserialization. Site administrators should apply the latest plugin update through the WordPress plugin manager and verify the installed version exceeds 1.24.11.
Workarounds
- Temporarily deactivate the UpdraftPlus plugin until the patched version is deployed.
- Avoid performing search and replace operations on any database containing untrusted content.
- Restrict access to the WordPress administration interface using network-level controls such as IP allow-lists or a VPN.
- Deploy a web application firewall rule that blocks requests containing serialized PHP object signatures targeting UpdraftPlus endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
