Unauthorized Access Vulnerability in WPvivid Plugin Could Lead to SQL Injection or DoS
CVE-2024-1982

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WPvivid — Backup, Migration & Staging
Vendor
CVE Published:
29 February 2024

What is CVE-2024-1982?

The WPvivid Backup and Migration plugin for WordPress has a flaw that permits unauthorized access due to a lack of proper capability checks in its get_restore_progress() and restore() functions. This vulnerability affects all versions up to and including 0.9.68. As a result, unauthorized users can exploit this weakness, potentially leading to SQL injection attacks or triggering denial-of-service conditions that could disrupt normal operations.

Affected Version(s)

WPvivid — Backup, Migration & Staging 0 <= 0.9.68

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://research.hisolutions.com/2024/01/multiple-vulnera...
https://plugins.trac.wordpress.org/changeset?old_path=%2F...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Denis Werner
.