CVE-2024-31254 LOW

CVE-2024-31254: WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerability

Vendor Webtoffee
Product WordPress Backup & Migration
Weakness CWE-532 · Sensitive info in logs
Published April 10, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.7.

Explanation of Vulnerability in Simple Terms

02Summary

The WordPress Backup & Migration plugin through version 1.4.7 exposes sensitive information in backup files or logs. An attacker with network access can retrieve partial data without authentication, though significant effort is required. This affects confidentiality but not data integrity or availability. Update to a version newer than 1.4.7.

What an attacker can do

03Attacker Capabilities

Read sensitive information from backup files or system logs without authentication.

Potential impact on your site

04Site Impact

Backup files or logs may leak sensitive data to unauthenticated attackers, risking exposure of credentials or configuration details.

Conditions required to exploit

05Prerequisites

Network access to the site; high attack complexity suggests the vulnerability requires specific conditions or timing.

Key dates

06Disclosure timeline

April 10, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2024-37930 WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerability CVE-2024-30511 WordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerability CVE-2024-25095 WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerability CVE-2021-25009 CorreosExpress <= 2.6.0 - Sensitive Information Disclosure CVE-2025-10486 Content Writer <= 3.6.8 - Unauthenticated Information Exposure via Log File