CVE-2024-10942 is a deserialization vulnerability (CWE-502) in the servmask All-in-One WP Migration and Backup plugin for WordPress, affecting all versions up to 7.89. It allows unauthenticated attackers to inject PHP objects through the 'replace_serialized_values' function. Exploitation requires an administrator to perform a backup export and restore operation. Although the vulnerable plugin lacks an internal POP chain, exploitation could be achieved if other installed plugins or themes provide one, potentially leading to arbitrary file deletion, data disclosure, or remote code execution.

Successful exploitation can lead to high-impact consequences including arbitrary file deletion, sensitive data exposure, and remote code execution, contingent on the presence of a POP chain in other installed components. The attack requires administrator interaction to export and restore backups, limiting the attack vector to scenarios involving privileged user actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid exporting and restoring backups using this plugin version. Review installed plugins and themes for potential POP chains that could be leveraged in conjunction with this vulnerability. Monitor vendor communications for updates and apply patches promptly once released.