CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through <= 1.4.1.
Explanation of Vulnerability in Simple Terms
The WordPress Backup & Migration plugin through version 1.4.1 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify or delete backup data without proper permission verification. The vulnerability affects the plugin's core backup management features and requires an active WordPress user account to exploit.
What an attacker can do
A low-privilege user can modify or delete backup data without authorization.
Potential impact on your site
Backup integrity is at risk; unauthorized users can tamper with or destroy site backups.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least low-level privileges.
Key dates
External resources
Related vulnerabilities
