CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through 1.4.0.
Explanation of Vulnerability in Simple Terms
The WordPress Backup & Migration plugin through version 1.4.0 fails to properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability requires an active WordPress account but no special interaction from other users.
What an attacker can do
Modify data in the plugin without proper authorization.
Potential impact on your site
Unauthorized users can alter backup or migration settings and data on your site.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
