CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup and Move: from n/a through <= 0.1.
Explanation of Vulnerability in Simple Terms
The Backup and Move plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to read sensitive data they should not access. An attacker with a standard user account can retrieve confidential information from the site without additional interaction. This vulnerability affects versions 0.1 and earlier.
What an attacker can do
Read sensitive data on the site that should be restricted to higher-privilege users.
Potential impact on your site
User data and site information may be exposed to any registered user, even those with minimal permissions.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role) on the WordPress site.
Key dates
External resources
