Backwpup
Monthly
REST API authorization bypass in BackWPup WordPress plugin (versions 5.2.2 through 5.7.4) allows users holding a plugin-defined limited role to invoke privileged backup management endpoints - creating jobs, specifying attacker-controlled destinations, and triggering execution to exfiltrate a complete database backup. WPScan reported the flaw and has published exploit code; vendor-released fix is available in version 5.7.5. No CISA KEV listing exists, but the public POC and high-value database credential exposure make this a genuine remediation priority for sites that have provisioned BackWPup limited roles to potentially untrusted users.
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable.
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
REST API authorization bypass in BackWPup WordPress plugin (versions 5.2.2 through 5.7.4) allows users holding a plugin-defined limited role to invoke privileged backup management endpoints - creating jobs, specifying attacker-controlled destinations, and triggering execution to exfiltrate a complete database backup. WPScan reported the flaw and has published exploit code; vendor-released fix is available in version 5.7.5. No CISA KEV listing exists, but the public POC and high-value database credential exposure make this a genuine remediation priority for sites that have provisioned BackWPup limited roles to potentially untrusted users.
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable.
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.