Visitors can access and download site backups, putting data at risk
CVE-2023-7164

Currently unrated

Key Information:

Vendor
Wordpress
Status
BackWPup
Vendor
CVE Published:
8 April 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

Affected Version(s)

BackWPup 0 < 4.0.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-7164 - Proof of Concept

References

https://wpscan.com/vulnerability/79b07f37-2c6b-4846-bb28-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
WPScan
.