Directory Traversal Vulnerabilities in BackWPup Plugin for WordPress

CVE-2011-5208

Summary

The BackWPup plugin for WordPress prior to version 1.4.1 contains multiple directory traversal vulnerabilities. These issues allow remote attackers to exploit the wpabs parameter, enabling them to read arbitrary files from the server. This can occur through specially crafted requests to the app/options-view_log-iframe.php or app/options-runnow-iframe.php scripts. The vulnerability poses a significant risk by providing unauthorized access to sensitive files, potentially leading to further attacks or information disclosure.

References