CVE-2024-3054
📋 TL;DR
The WPvivid Backup & Migration WordPress plugin is vulnerable to PHAR deserialization, allowing authenticated attackers with admin access to potentially execute arbitrary PHP objects. This could lead to file deletion, data theft, or remote code execution if other vulnerable plugins/themes are present. Only WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- WPvivid Backup & Migration Plugin for WordPress
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if a POP chain exists in other installed components
Likely Case
Arbitrary file deletion or sensitive data exposure through deserialization attacks
If Mitigated
Limited impact due to admin-only access requirement and lack of POP chain in the plugin itself
🎯 Exploit Status
Exploitation requires admin credentials and potentially additional vulnerable plugins/themes for full impact
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 0.9.99
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3067224%40wpvivid-backuprestore&new=3067224%40wpvivid-backuprestore
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WPvivid Backup & Migration
4. Click 'Update Now' if available
5. Alternatively, download latest version from WordPress repository and manually update
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the WPvivid Backup & Migration plugin until patched
wp plugin deactivate wpvivid-backuprestore
Restrict admin access
allImplement strict access controls and monitoring for admin accounts
🧯 If You Can't Patch
- Remove the WPvivid Backup & Migration plugin completely
- Implement web application firewall rules to block requests to wpvividstg_get_custom_exclude_path_free action
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WPvivid Backup & Migration version numberCheck Version:
wp plugin get wpvivid-backuprestore --field=versionVerify Fix Applied:
Verify plugin version is greater than 0.9.99📡 Detection & Monitoring
Log Indicators:
- POST requests to wp-admin/admin-ajax.php with action=wpvividstg_get_custom_exclude_path_free
- Unusual file operations or PHP errors related to deserialization
Network Indicators:
- HTTP requests containing PHAR:// wrappers in parameters
- Admin-level authentication followed by suspicious plugin-specific requests
SIEM Query:
source="web_logs" AND uri="*/admin-ajax.php" AND params="*wpvividstg_get_custom_exclude_path_free*"🔗 References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3067224%40wpvivid-backuprestore&new=3067224%40wpvivid-backuprestore&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bf26fc68-9fd4-4e4e-b34f-c947d95891f9?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3067224%40wpvivid-backuprestore&new=3067224%40wpvivid-backuprestore&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bf26fc68-9fd4-4e4e-b34f-c947d95891f9?source=cve
