What the vulnerability does
01Description
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replace_row_data' and 'replace_serialize_data' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site to trigger the exploit.
Explanation of Vulnerability in Simple Terms
02Summary
WPvivid Backup, Migration & Staging versions up to 0.9.107 contain a deserialization vulnerability that allows attackers to execute arbitrary code on the site. An attacker can craft a malicious serialized object and trick a site user into interacting with it, leading to remote code execution with full site compromise. Update to a version newer than 0.9.107 immediately.
What an attacker can do
03Attacker Capabilities
Run their own code on the site by sending a malicious serialized object to a user.
Potential impact on your site
04Site Impact
Complete site compromise, including data theft, malware injection, and loss of availability.
Conditions required to exploit
05Prerequisites
A site user must click a link or visit a page containing the attacker's payload.
Key dates
06Disclosure timeline
November 14, 2024
CVE published
April 8, 2026
Record updated
