Directory Traversal Vulnerability in WordPress Database Backup Plugin

CVE-2024-12850

Summary

The Database Backup and Check Tables Automated With Scheduler plugin for WordPress is susceptible to a directory traversal vulnerability due to flaws in the database_backup_ajax_download() function. This vulnerability permits authenticated users with administrator-level access and higher to traverse the directory structure of the server, thereby gaining access to potentially sensitive files. Attackers exploiting this vulnerability can read arbitrary file contents on the server, leading to severe security breaches. Website administrators using this plugin should apply necessary updates and implement security measures to mitigate these risks.

References