CVE-2024-10932 is a PHP Object Injection vulnerability in the BackupBliss WordPress plugin (versions up to 1.4.6) caused by unsafe deserialization of untrusted input in the 'recursive_unserialize_replace' function. An unauthenticated attacker can inject malicious PHP objects, leveraging a POP chain to achieve arbitrary file deletion, data disclosure, or code execution. Exploitation requires an administrator to create a staging site, which triggers the vulnerable code path. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, but user interaction needed, and high impact on confidentiality, integrity, and availability.

The vulnerability allows unauthenticated attackers to inject PHP objects via deserialization, potentially leading to deletion of arbitrary files, exposure of sensitive information, or remote code execution. However, exploitation requires an administrator to perform an action (creating a staging site), which limits the attacker's capabilities to some extent. The high CVSS score indicates significant potential impact on system confidentiality, integrity, and availability if exploited.

No official patch or fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should avoid creating staging sites using the vulnerable plugin version and consider disabling or removing the plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.