Vulnerability · Published Jan 9, 2025 · Assigned by Wordfence
CVE-2024-12330WP Database Backup – Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposure
High 7.5
In plain English
A high-severity security flaw in WP Database Backup – Unlimited Database & Files Backup by Backup for WP from databasebackup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| databasebackup | WP Database Backup – Unlimited Database & Files Backup by Backup for WP | 0 – through 7.3 |
Weakness: CWE-530 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3f36839b-850e-4c39-aa61-4fd7a89cd5bc?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209380%40wp-database-backup&new=3209380%40wp-database-backup&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209387%40wp-database-backup&new=3209387%40wp-database-backup&sfp_email=&sfph_mail=