CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.
Explanation of Vulnerability in Simple Terms
The Backup Migration plugin for WordPress contains a vulnerability that exposes sensitive backup files. An attacker on the network can access these files without authentication or user interaction. The vulnerability affects versions 1.2.8 and requires immediate patching to prevent unauthorized access to site backups.
What an attacker can do
Read backup files containing sensitive site data without logging in.
Potential impact on your site
Attackers can download complete site backups, exposing databases, user data, and configuration files.
Conditions required to exploit
Network access to the WordPress site; no authentication required.
Key dates
External resources
Related vulnerabilities
