CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.13 via the exposed process stats file during the backup process. This makes it possible for unauthenticated attackers to obtain an archive file name and download the site's backup.
Explanation of Vulnerability in Simple Terms
The Everest Backup plugin for WordPress contains an information disclosure vulnerability that allows unauthenticated attackers to read sensitive data over the network. The plugin fails to properly restrict access to backup-related functionality, exposing confidential information without requiring authentication or user interaction. All versions up to 2.2.13 are affected. Site administrators should update immediately to a patched version.
What an attacker can do
Read sensitive backup data and site information without logging in.
Potential impact on your site
Attackers can access your site's backup files and sensitive configuration data remotely.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
