CVE-2024-10962 is a PHP Object Injection vulnerability in the WPvivid Backup, Migration & Staging plugin for WordPress, affecting all versions up to 0.9.107. The issue arises from unsafe deserialization of untrusted input in the 'replace_row_data' and 'replace_serialize_data' functions. While the plugin alone does not contain a POP chain, the presence of additional plugins or themes could enable exploitation leading to file deletion, data disclosure, or code execution. Exploitation requires an administrator to create a staging site, which triggers the vulnerable code path.

Successful exploitation could lead to high impact including confidentiality, integrity, and availability breaches. Specifically, attackers could delete arbitrary files, retrieve sensitive information, or execute arbitrary code if a suitable POP chain exists in the environment. The vulnerability requires administrative action to trigger, limiting the attack surface to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and avoid creating staging sites with untrusted input. Monitor vendor channels for updates and apply patches promptly once available.