Website Security Insights

UpdraftPlus Migration Plugin Vulnerability – CVE-2024-10957

David Pottrell

David Pottrell

Hi! I’m a web developer and Head of Digital at Nebula Design who loves all things tech. When I’m not surrounded by code, I’m probably reading up on the latest development trends or on the pottery wheel.

I got my start in technology as a self-taught web freelancer, after studying at university and joining a small agency, Nebula Design was created. I specialise in both front-end and back-end development, typically around WordPress, I’ve also got expertise in Search Engine Optimisation, Ecommerce and various emerging tech standards.

Published on January 6th, 2025

Overview

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.24.11 via deserialization of untrusted input in the ‘recursive_unserialized_replace’ function. This makes it possible for unauthenticated attackers to inject a PHP Object.

Affected Plugin: UpdraftPlus: WP Backup & Migration Plugin Version <= 1.24.11

The UpdraftPlus Backup & Migration Plugin is trusted by the WordPress community to backup, restore and migrate their WordPress websites. UpdraftPlus is actively installed on more than 3 million websites around the world.

Preventive Measures

To protect your WordPress website from similar vulnerabilities in the future, consider the following best practices:

  • Regularly update all plugins, themes, and WordPress core files. Vulnerabilities are often discovered and patched in subsequent updates.
  • Implement privilege access by ensuring that only authorised users have access to sensitive site functionality like file management.
  • Use two-factor authentication (2FA) for logging in to the WordPress admin area.
  • Consider using manual file management through secure FTP instead of relying on file management plugins with web-based access.

Conclusion

The WP Backup & Migration plugin has been patched. It is advised to update to version 1.24.12, or a newer patched version.

For more information on WordPress security and steps to protect your site, feel free to reach out on our contact page or feel free to book a discovery call