Arbitrary File Download Vulnerability in Simple Backup Plugin for WordPress

CVE-2015-10134

What is CVE-2015-10134?

The Simple Backup plugin for WordPress is compromised due to an Arbitrary File Download vulnerability found in versions up to 2.7.10. This vulnerability arises from insufficient capability checks and file type validation in the download_backup_file function. As a result, attackers can exploit this weakness to download sensitive files, such as the wp-config.php file, from vulnerable installations, potentially leading to unauthorized access to critical site information.

References