Vulnerability · Published Dec 23, 2023 · Assigned by Wordfence
CVE-2023-7002Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url
High 7.2
In plain English
A high-severity OS command injection in BackupBliss – Backup & Migration with Free Cloud Storage from inisev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 30.8% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)30.8%top 1.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| inisev | BackupBliss – Backup & Migration with Free Cloud Storage | 0 – through 1.3.9 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cc49db10-988d-42bd-a9cf-9a86f4c79568?source=cve
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L88
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1518
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1503
- https://www.linuxquestions.org/questions/linux-security-4/php-function-exec-enabled-how-big-issue-4175508082/
- https://plugins.trac.wordpress.org/changeset/3012745/backup-backup