Description

WordPress Plugin Migration, Backup, Staging-WPvivid is prone to a deserialization vulnerability. Attackers can possibly exploit this issue to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions, granted a POP chain is also present. WordPress Plugin Migration, Backup, Staging-WPvivid version 0.9.74 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 0.9.75 or latest

References

https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2442

Related Vulnerabilities

Oracle JRE CVE-2010-0840 Vulnerability (CVE-2010-0840)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-6388)

Pega Infinity CVE-2021-27653 Vulnerability (CVE-2021-27653)

WordPress Plugin Affiliate Power-Sales Tracking for Affiliate Marketers Cross-Site Scripting (2.2.0)

WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk SQL Injection (5.153.3)

Severity

High

Classification

CVE-2022-2442 CWE-502 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update