CVE-2024-3054

CVE-2024-3054 is a PHAR Deserialization vulnerability affecting all versions of the WPvivid Backup & Migration Plugin for WordPress up to and including 0.9.99. This flaw allows authenticated attackers with administrative privileges to deserialize untrusted input via insufficient path validation, potentially leading to arbitrary PHP object calls. The vulnerability carries a CVSS score of 7.2 (HIGH), indicating a high potential for impact including data compromise, integrity loss, and availability issues if a suitable POP chain exists on the system. While no POP chain is present in the plugin itself, its presence in other installed components could enable file deletion, sensitive data retrieval, or code execution. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.