CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all versions up to, and including, 2.5.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
CYAN Backup versions 2.5.4 and earlier contain a path traversal vulnerability that allows authenticated administrators to read, write, or delete arbitrary files on the server. An attacker with high-level privileges can manipulate file paths during backup or restore operations to access files outside the intended backup directory, potentially compromising the entire site.
What an attacker can do
Read, write, or delete arbitrary files on the server outside the backup directory.
Potential impact on your site
A compromised admin account could be used to modify or delete critical site files, leading to data loss or site takeover.
Conditions required to exploit
Attacker must have administrator-level access to the site.
Key dates
External resources
Related vulnerabilities
