CVE-2023-6972 Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
CriticalCVSS 9.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress backup-backup(WordPress) | < 1.4.0 | 1.4.0 |
| Inisev BackupBliss – Backup & Migration with Free Cloud Storage | <= 1.3.9 | No fix listed |
| Backupbliss backup migration | < 1.4.0 | 1.4.0 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- www.wordfence.com patch third-party-advisory
- plugins.trac.wordpress.org patch
- plugins.trac.wordpress.org patch
- plugins.trac.wordpress.org patch