Directory Traversal Vulnerability in XCloner Plugin for WordPress and Joomla!

CVE-2014-8605

Summary

The XCloner plugin versions 3.1.1 for WordPress and 3.5.1 for Joomla! suffers from a directory traversal vulnerability, allowing remote attackers to access sensitive database backup files. These backups are stored under predictable names and insufficient access controls, enabling unauthorized users to exploit the system by directly requesting files in the administrators/backups/ directory. Organizations using this plugin should consider removing or securing backup files to protect sensitive information effectively.

References