TUTORIAL Severe Vulnerability Discovered In Popular WordPress Plugin UpdraftPlus

The WordPress community is once again reminded of the importance of maintaining updated plugins as a severe vulnerability has been discovered in the popular UpdraftPlus: WP Backup & Migration Plugin. This flaw, identified as a PHP Object Injection vulnerability, has been patched in the latest release (v1.24.12). Users are strongly urged to update immediately to safeguard their websites.

The Vulnerability: Deserialization of Untrusted Data​

Researchers at Webbernaut uncovered a critical issue in versions of UpdraftPlus up to and including 1.24.11. The vulnerability resides in the recursive_unserialized_replace function, allowing unauthenticated attackers to exploit PHP Object Injection. Although no known POP (Property-Oriented Programming) chain exists within UpdraftPlus itself, the presence of such a chain in another installed plugin or theme could lead to dire consequences, including:

• Deletion of Arbitrary Files: Attackers could remove critical files from your server.
• Sensitive Data Retrieval: Confidential information may be exposed.
• Code Execution: Malicious actors could execute harmful code, potentially compromising your entire site.

It’s important to note that for the exploit to be triggered, an administrator must perform a search and replace action, making this vulnerability less likely to affect sites with careful administrative practices.

Risk Assessment​

• CVSS Score: 8.8 (High)
• Vulnerability Type: PHP Object Injection
• Affected Versions: UpdraftPlus <= 1.24.11
• Patched Version: 1.24.12
• CVE: CVE-2024-10957
• Public Disclosure Date: January 3, 2025

Recommendations​

1. Update Immediately: If you are using any version of UpdraftPlus <= 1.24.11, update to version 1.24.12 or newer. This is the most effective way to protect your website.
2. Review Installed Plugins and Themes: Check for additional plugins or themes that may contain vulnerable POP chains. Keeping all your WordPress components updated is crucial to minimizing potential risks.
3. Implement Security Best Practices:
   • Regularly back up your website using updated, secure tools.
   • Limit administrative actions, such as search and replace, to trusted personnel.
   • Consider using a WordPress firewall like Wordfence for proactive threat monitoring and mitigation.

Why This Matters​

The UpdraftPlus plugin is widely used for website backups and migrations, making it a critical target for attackers. A vulnerability of this magnitude can severely impact businesses, lead to data breaches, and tarnish reputations. By acting quickly and following recommended best practices, website owners can mitigate risks and maintain the integrity of their websites.

Stay vigilant, keep your plugins updated, and prioritize security to protect your online presence!