All-in-One WP Migration PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the All-in-One WP Migration and Backup plugin for WordPress, affecting all versions through 7.89. The vulnerability arises from the deserialization of untrusted input in the 'replace_serialized_values' function, allowing unauthenticated attackers to inject PHP objects. While no known payload chain exists within the vulnerable software itself, the presence of such a chain through an additional plugin or theme could enable an attacker to delete arbitrary files, access sensitive data, or execute code. To exploit this vulnerability, an administrator must export and restore a backup.

Impact

Exploitation of this vulnerability could lead to unauthorized PHP object injection, with the potential for additional impacts depending on the presence of a suitable payload execution chain through other installed plugins or themes.

Remediation

Users are advised to update the All-in-One WP Migration and Backup plugin to version 7.90 or a newer patched version.