A critical vulnerability was identified and fixed in the All-in-One WP Migration and Backup plugin, which has more than five million users. This vulnerability does not require user authentication, allowing an attacker to more easily compromise a website; however, the potential for attack is limited by a specific exploitation method.
The vulnerability was given a severity rating of 7.5 (High), which is below the highest severity classification known as Critical.
Unauthenticated PHP Object Injection
The vulnerability is identified as an unauthenticated PHP object injection. However, it is not as critical as a standard unauthenticated PHP object injection that allows an attacker to exploit it directly. To activate this particular vulnerability, it is necessary for a user with administrative privileges to export and restore a backup using the plugin.
This type of vulnerability operates by allowing the WordPress plugin to handle potentially harmful data during the backup restoration process without adequate verification. However, the limited window of opportunity for attacks makes it more challenging to exploit.
However, if the appropriate conditions are satisfied, an attacker may be able to remove files, access confidential information, and execute harmful code.
Plugins are what make WordPress great, but they can also be a source of vulnerabilities if not properly managed.
As stated in a report by Wordfence:
The All-in-One WP Migration and Backup plugin for WordPress is susceptible to PHP Object Injection in every version up to and including 7.89 due to the deserialization of untrusted input within the ‘replace_serialized_values’ function.
This allows unauthorized attackers to introduce a PHP Object. The vulnerable software does not contain any known POP chain. However, if an additional plugin or theme on the target system has a POP chain, it could enable the attacker to delete any files, access sensitive information, or run code. To activate the exploit, an administrator needs to export and restore a backup.
The flaw impacts all versions up to and including 7.89. Users of the plugin are advised to upgrade to the latest version, which is 7.90 as of this writing.
Review the Wordfence vulnerability alert:
All in One WP Migration versions up to 7.89 are vulnerable to unauthenticated PHP object injection.
