CVE-2024-3054: WPvivid Backup Plugin RCE Vulnerability

CVE-2024-3054 Overview

CVE-2024-3054 affects the WPvivid Backup & Migration plugin for WordPress in all versions up to and including 0.9.99. The vulnerability enables PHAR deserialization through the wpvividstg_get_custom_exclude_path_free AJAX action. The plugin fails to validate the tree_node[node][id] parameter, allowing attackers to invoke files using a PHAR wrapper that triggers deserialization of arbitrary PHP objects. Exploitation requires administrator-level authentication. The plugin itself contains no Property-Oriented Programming (POP) chain, but a POP chain supplied by another installed plugin or theme can lead to arbitrary file deletion, sensitive data disclosure, or remote code execution [CWE-502].

Critical Impact
Authenticated administrators can trigger PHP object instantiation via PHAR streams, enabling code execution when a POP chain exists in another installed component.

Affected Products

WPvivid Migration, Backup, Staging plugin for WordPress
All versions up to and including 0.9.99
Deployments where additional plugins or themes provide a usable POP chain

Discovery Timeline

2024-04-12 - CVE-2024-3054 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3054

Vulnerability Analysis

The flaw resides in the wpvividstg_get_custom_exclude_path_free action handler exposed by the WPvivid Backup & Migration plugin. The handler accepts a tree_node[node][id] parameter representing a filesystem path and passes it to PHP file-handling functions without validating the stream wrapper. PHP interprets paths prefixed with phar:// as PHAR archives, deserializing embedded metadata whenever the file is stat'd, read, or otherwise accessed.

An attacker with administrator privileges uploads or references a crafted PHAR archive on the target system. Supplying a phar:// URL to the vulnerable parameter forces PHP to unserialize the archive metadata into live PHP objects. Because WPvivid contains no exploitable POP chain internally, remote code execution depends on gadget classes autoloaded from other installed plugins, themes, or the WordPress core. This is a common condition on production WordPress sites running multiple extensions.

Root Cause

The root cause is insufficient path validation in the AJAX handler. The plugin does not restrict stream wrappers or normalize the supplied path before invoking filesystem functions. This satisfies the classic PHAR deserialization pattern documented as [CWE-502] Deserialization of Untrusted Data.

Attack Vector

Exploitation follows a two-stage pattern. First, the attacker plants a malicious PHAR archive on the server, typically through a media upload, log poisoning, or another plugin feature that writes attacker-controlled content to disk. Second, the attacker calls the wpvividstg_get_custom_exclude_path_free action with tree_node[node][id] set to phar://path/to/archive.ext/test. PHP parses the PHAR metadata and instantiates the serialized objects, triggering magic methods such as __destruct or __wakeup in any gadget classes present in the runtime.

Description of exploitation is limited to prose because no verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-3054

Indicators of Compromise

HTTP requests to admin-ajax.php invoking the wpvividstg_get_custom_exclude_path_free action from administrator sessions
Request bodies or query strings containing phar:// substrings in the tree_node[node][id] parameter
Recently written files with non-standard extensions such as .jpg, .png, or .txt located in wp-content/uploads/ that contain PHAR magic bytes (<?php __HALT_COMPILER();)
Unexpected PHP worker processes spawning shells, cron jobs, or outbound connections shortly after administrator activity

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php where the action parameter equals wpvividstg_get_custom_exclude_path_free and the payload contains phar:// or URL-encoded variants (phar%3A%2F%2F)
Enable PHP phar.readonly = On monitoring and alert on any deserialization errors logged by the PHP interpreter
Scan the wp-content/uploads/ directory for files whose contents begin with the PHAR stub signature but carry non-executable extensions

Monitoring Recommendations

Forward WordPress audit logs and web server logs to a centralized analytics platform to correlate administrator authentication events with plugin AJAX calls
Monitor for creation of new administrator accounts or plugin installations preceding requests to WPvivid endpoints
Track outbound network connections originating from the PHP-FPM or Apache worker processes after WPvivid activity

How to Mitigate CVE-2024-3054

Immediate Actions Required

Update the WPvivid Backup & Migration plugin to a version later than 0.9.99 that includes the fix committed in WordPress plugin changeset 3067224
Rotate all WordPress administrator credentials and review the user roster for unauthorized accounts
Audit wp-content/uploads/ and other web-writable directories for files containing PHAR stubs

Patch Information

The vendor addressed the vulnerability by adding path validation to the affected AJAX handler. The fix is available in the WordPress plugin repository through the WordPress Plugin Changeset 3067224. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Deactivate the WPvivid Backup & Migration plugin until the site can be updated to a patched release
Set phar.readonly = On in php.ini to prevent creation of new PHAR archives at runtime
Restrict administrator access to trusted IP addresses using web server ACLs or a Web Application Firewall (WAF) rule blocking phar:// in request parameters

bash

# Configuration example: block phar:// in requests via ModSecurity
SecRule ARGS "@contains phar://" \
  "id:1004201,phase:2,deny,status:403,log,\
   msg:'Blocked PHAR wrapper in request parameter (CVE-2024-3054)'"