CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-6271 – Backup Migration Staging < 1.3.6 - Sensitive Data Exposure
https://notcve.org/view.php?id=CVE-2023-6271
The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups. El complemento Backup Migration de WordPress anterior a 1.3.6 almacena información de las copias de seguridad en progreso en archivos fáciles de encontrar y de acceso público, lo que puede permitir a los atacantes monitorearlos para filtrar información confidencial de las copias de seguridad del sitio. The Backup Migration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5. This makes it possible for unauthenticated attackers to extract database backups leading to the potential for a complete site takeover. • https://research.cleantalk.org/cve-2023-6271-backup-migration-unauth-sensitive-data-exposure-to-full-control-of-the-site-poc-exploit https://wpscan.com/vulnerability/7ac217db-f332-404b-a265-6dc86fe747b9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6266 – Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
https://notcve.org/view.php?id=CVE-2023-6266
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more. El complemento Backup Migration para WordPress es vulnerable al acceso no autorizado a los datos debido a una ruta y una validación de archivos insuficientes en el caso BMI_BACKUP de la función handle_downloading en todas las versiones hasta la 1.3.6 incluida. Esto hace posible que atacantes no autenticados descarguen archivos de respaldo que pueden contener información confidencial como contraseñas de usuario, PII, credenciales de bases de datos y mucho más. • https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L1048 https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L972 https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/initializer.php#L1065 https://www.wordfence.com/threat-intel/vulnerabilities/id/08801f53-3c57-41a3-a637-4b52637cc612?source=cve • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-552: Files or Directories Accessible to External Parties •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2023-0958 – Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
https://notcve.org/view.php?id=CVE-2023-0958
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability. • https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427 https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434 https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426 https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434 https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339 • CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 18CVE-2023-3977 – Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
https://notcve.org/view.php?id=CVE-2023-3977
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427 https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434 https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426 https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434 https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36884 – WordPress Backup Migration plugin <= 1.1.5 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-36884
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions. Se ha detectado una vulnerabilidad de tipo Cross-Site Scripting (XSS) persistentes y autenticadas en el plugin Backup Migration de WordPress versiones anteriores a 1.1.5 incluyéndola • https://patchstack.com/database/vulnerability/backup-backup/wordpress-backup-migration-plugin-1-1-5-authenticated-persistent-cross-site-scripting-xss-vulnerability https://wordpress.org/plugins/backup-backup/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •