CVE-2024-10962: WPvivid Migration Plugin RCE Vulnerability

CVE-2024-10962 Overview

CVE-2024-10962 affects the Migration, Backup, Staging – WPvivid plugin for WordPress through version 0.9.107. The vulnerability is a PHP Object Injection flaw [CWE-502] caused by deserialization of untrusted input in the replace_row_data and replace_serialize_data functions. Unauthenticated attackers can inject PHP objects, and if a Property-Oriented Programming (POP) chain exists in another installed plugin or theme, the injection can lead to arbitrary file deletion, sensitive data disclosure, or code execution. Exploitation requires an administrator to first create a staging site, which serves as the trigger condition.

Critical Impact
Unauthenticated PHP Object Injection across the entire codebase up to 0.9.107, enabling potential code execution or file deletion when a POP chain is available.

Affected Products

WPvivid Migration, Backup, Staging plugin for WordPress
All versions up to and including 0.9.107
WordPress sites where an administrator has created a staging site

Discovery Timeline

2024-11-14 - CVE-2024-10962 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10962

Vulnerability Analysis

The vulnerability stems from unsafe deserialization of attacker-controlled input inside the staging database copy logic of the WPvivid plugin. The replace_row_data and replace_serialize_data functions in class-wpvivid-staging-copy-db-ex.php process serialized PHP data without validating that the input originates from a trusted source. When PHP encounters serialized object data, it invokes magic methods such as __wakeup, __destruct, or __toString during reconstruction. An attacker who controls the serialized payload can craft objects whose magic methods chain into dangerous operations exposed by other plugins or themes installed on the site.

Root Cause

The root cause is the use of PHP's unserialize() (or equivalent serialization handling) on untrusted input without integrity checks or allow-listing of expected classes. The plugin treats data flowing through the staging database migration path as safe, even though it can be influenced by remote actors. This is a textbook violation of CWE-502: Deserialization of Untrusted Data.

Attack Vector

The attack vector is network-based and requires no authentication, but it does require user interaction in the form of an administrator creating a staging site. Once that precondition is met, an attacker submits a crafted serialized payload that flows into replace_row_data or replace_serialize_data. The WPvivid plugin itself contains no known POP chain, so impact depends on other plugins or themes present on the host. With a viable gadget chain, the attacker can delete arbitrary files, exfiltrate sensitive data, or achieve arbitrary code execution in the WordPress process context. Technical details are documented in the Wordfence Vulnerability Analysis and the affected source is visible in the WordPress Plugin Code Snippet.

// No verified public exploit code is available for CVE-2024-10962.
// Refer to the Wordfence advisory and the WordPress plugin source
// for the vulnerable deserialization sinks in:
//   class-wpvivid-staging-copy-db-ex.php:1104 (replace_row_data)
//   class-wpvivid-staging-copy-db-ex.php:1120 (replace_serialize_data)

Detection Methods for CVE-2024-10962

Indicators of Compromise

Unexpected creation of WPvivid staging environments by accounts that do not normally perform migrations.
Web server logs showing requests to WPvivid staging endpoints containing serialized PHP markers such as O: or a: followed by class names.
New, modified, or deleted PHP files under wp-content/ or unexpected outbound connections from the PHP worker.
WordPress error logs referencing magic methods (__wakeup, __destruct) tied to unrelated plugins or themes.

Detection Strategies

Inventory WordPress sites and flag any installation of WPvivid Migration, Backup, Staging at version 0.9.107 or earlier.
Inspect HTTP request bodies and parameters reaching WPvivid staging handlers for serialized PHP object patterns.
Correlate WPvivid staging activity with subsequent file system changes, privilege escalations, or new administrator accounts.

Monitoring Recommendations

Enable verbose logging for WordPress administrative actions, especially staging site creation events.
Monitor for outbound connections initiated by PHP-FPM or Apache workers that fall outside normal patterns.
Alert on integrity changes to wp-config.php, theme files, and plugin directories.

How to Mitigate CVE-2024-10962

Immediate Actions Required

Update the WPvivid Migration, Backup, Staging plugin to a version newer than 0.9.107 that includes the fix from WordPress Changeset 3186082.
If immediate patching is not possible, deactivate and remove the WPvivid plugin from production sites.
Audit existing staging sites for unauthorized files, modified plugins, or rogue administrator accounts.
Review the full list of installed plugins and themes for known POP gadget chains that could compound the impact.

Patch Information

The vendor addressed the vulnerability in WordPress Changeset 3186082. Site operators should upgrade WPvivid to the latest available release through the WordPress plugin updater. Confirm the installed version is greater than 0.9.107 after applying the update.

Workarounds

Restrict administrator access so that staging site creation is only performed by trusted personnel, removing the user interaction precondition for exploitation.
Deploy a web application firewall rule that blocks requests containing serialized PHP object markers targeting WPvivid endpoints.
Remove or disable unused plugins and themes to reduce the gadget surface available for POP chain construction.
Limit filesystem write permissions for the web server user to minimize damage from a successful object injection.

bash

# Verify the installed WPvivid plugin version via WP-CLI
wp plugin get wpvivid-backuprestore --field=version

# Update WPvivid to the patched release
wp plugin update wpvivid-backuprestore

# If patching is not yet possible, deactivate the plugin
wp plugin deactivate wpvivid-backuprestore