CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
The Super Backup & Clone plugin for WordPress versions 2.3.3 and earlier allows unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious PHP files or other executable code, then access them to run their own code on the site. This requires only network access and no user interaction.
What an attacker can do
Upload and execute arbitrary files, including PHP code, to run commands on the site.
Potential impact on your site
An attacker can take full control of your site, steal data, modify content, or use it to attack other sites.
Conditions required to exploit
None. The vulnerability is accessible over the network without authentication or user interaction.
Key dates
External resources
Related vulnerabilities
