CVE-2011-5208 BackWPup – WordPress Backup Plugin < 1.4.1 - Directory Traversal
MediumCVSS 5.0
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple directory traversal vulnerabilities in the BackWPup plugin before 1.4.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the wpabs parameter to (1) app/options-view_log-iframe.php or (2) app/options-runnow-iframe.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| backwpup | <= 1.4.0 | No fix listed |
| wordpress backwpup(WordPress) | < 1.4.1 | 1.4.1 |
References
- 20110228 BackWPup Wordpress plugin <= 1.4.0 File content disclosure exploit mailing-list
- 43565 third-party-advisory vendor-advisory
- wordpress.org
- 71242 vdb-entry
- 71243 vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org