CVE-2024-43268 MEDIUM

CVE-2024-43268: WordPress Backup and Restore WordPress plugin <= 1.50 - Broken Access Control vulnerability

Vendor Wpbackitup
Product Backup and Restore WordPress
Weakness CWE-862 · Missing authorization
Published November 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Access Control vulnerability in WPBackItUp Backup and Restore WordPress allows . This issue affects Backup and Restore WordPress: from n/a through 1.50.

Explanation of Vulnerability in Simple Terms

02Summary

The WPBackItUp Backup and Restore plugin for WordPress does not properly check user permissions before allowing access to backup and restore functions. A logged-in user with low privileges can read or modify backups without authorization. This affects versions up to 1.50. Update to a version newer than 1.50 to resolve the issue.

What an attacker can do

03Attacker Capabilities

A low-privilege user can read or modify site backups without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users can access, download, or restore backups, risking data exposure or site integrity.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

November 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12119 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute CVE-2026-57339 WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability CVE-2026-12134 JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action CVE-2026-39448 WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability CVE-2026-13468 Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint