CVE-2024-10942

The All-in-One WP Migration and Backup plugin through version 7.89 contains a PHP Object Injection vulnerability in the 'replace_serialized_values' function that processes untrusted serialized data without proper validation. Unauthenticated attackers can inject malicious PHP objects during the backup export and restore process. While the plugin itself lacks a known gadget chain for code execution, the presence of vulnerable code in other installed plugins or themes could be leveraged to achieve arbitrary file deletion, sensitive information disclosure, or remote code execution. The vulnerability requires an administrator to export and restore a backup to be triggered.

Based on public CVE data (MITRE/NVD).