CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
LearnPress – Backup & Migration Tool versions 4.1.4 and earlier contain a path traversal vulnerability that allows high-privilege users to read arbitrary files from the server. An attacker with administrator or equivalent access can bypass directory restrictions and access sensitive files outside the intended backup scope, potentially exposing database credentials, configuration files, or other confidential data.
What an attacker can do
Read arbitrary files from the server filesystem.
Potential impact on your site
Administrators with malicious intent or compromised admin accounts can extract sensitive files like wp-config.php or database backups.
Conditions required to exploit
Attacker must have high-level site privileges (administrator or equivalent role).
Key dates
External resources
