Directory Traversal Vulnerability in XCloner Plugin for WordPress and Joomla!
CVE-2014-8605

Currently unrated

Key Information:

Vendor

Wordpress
Status
Xcloner
Vendor
CVE Published:
10 June 2015

What is CVE-2014-8605?

The XCloner plugin versions 3.1.1 for WordPress and 3.5.1 for Joomla! suffers from a directory traversal vulnerability, allowing remote attackers to access sensitive database backup files. These backups are stored under predictable names and insufficient access controls, enabling unauthorized users to exploit the system by directly requesting files in the administrators/backups/ directory. Organizations using this plugin should consider removing or securing backup files to protect sensitive information effectively.

References

http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcl...
x_refsource_MISC
http://www.vapid.dhs.org/advisory.php?v=110
x_refsource_MISC

EPSS Score

7% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.