Wordpress Backup Migration
Monthly
Unauthenticated access control failure in the WebToffee WordPress Backup & Migration plugin (slug wp-migration-duplicator) through version 1.6.0 allows remote attackers to read protected resources without credentials or user interaction; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5) reflects a high confidentiality impact with no integrity or availability effect. Any WordPress site with this plugin installed and active at or below 1.6.0 is exposed, while sites that have upgraded past 1.6.0 or that do not run the plugin are unaffected. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated access control failure in the WebToffee WordPress Backup & Migration plugin (slug wp-migration-duplicator) through version 1.6.0 allows remote attackers to read protected resources without credentials or user interaction; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5) reflects a high confidentiality impact with no integrity or availability effect. Any WordPress site with this plugin installed and active at or below 1.6.0 is exposed, while sites that have upgraded past 1.6.0 or that do not run the plugin are unaffected. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.