Cross-Site Request Forgery in wp-database-backup Plugin for WordPress
CVE-2016-10874

8.8HIGH

Key Information:

Vendor

Wordpress
Status
WP Database Backup
Vendor
CVE Published:
12 August 2019

What is CVE-2016-10874?

The wp-database-backup plugin prior to version 4.3.3 is susceptible to a Cross-Site Request Forgery (CSRF) attack. This vulnerability allows an attacker to trick an authenticated user into performing actions they did not intend. As a result, sensitive data in the database could be manipulated or exposed without the user’s knowledge. It is crucial for users of the plugin to upgrade to the latest version to safeguard their applications against potential exploitation.

References

https://wordpress.org/plugins/wp-database-backup/#developers
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9739
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.