CVE-2024-10932: Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'
Vulnerability summary
CVE-2024-10932 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in inisev backupbliss – backup & migration with free cloud storage. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities.
Timeline
- 04-01-2025PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.80% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Inisev1 product
Wordpress1 product
- backup-backup≤ 1.4.6 (fixed in 1.4.6.1)
2 vendors · 2 products