CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
Explanation of Vulnerability in Simple Terms
WP SuperBackup versions 2.3.3 and earlier lack proper authorization checks, allowing authenticated users with low privileges to access backup functionality and modify site data beyond their intended permissions. The vulnerability affects confidentiality, integrity, and availability. An attacker needs a valid WordPress account to exploit it.
What an attacker can do
Access and modify backup data and site content beyond their assigned role permissions.
Potential impact on your site
Unauthorized users can read, modify, or delete backups and potentially access sensitive site data.
Conditions required to exploit
Attacker must have a valid low-privilege WordPress account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
