Sensitive Information Disclosure Vulnerability in WPvivid Plugin

CVE-2020-36835

4.9MEDIUM

Key Information

Vendor: WPvividplugins
Status: Migration, Backup, Staging – WPvivid
Vendor: CVE Published:; 16 October 2024

Summary

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.

Affected Version(s)

Migration, Backup, Staging – WPvivid < 0.9.36

CVSS V3.1

Score:

4.9

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Oct 16, 2024
Vulnerability Reserved.
Oct 15, 2024
Disclosed
Mar 23, 2020

Collectors

NVD DatabaseMitre Database

Credit

WebARX Security