Vulnerability · Published Mar 13, 2023 · Assigned by Patchstack
CVE-2022-31474WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal
High 7.5
In plain English
A high-severity path traversal in BackupBuddy from iThemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 63.8% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)63.8%top 0.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| iThemes | BackupBuddy | 8.5.8.0 – through 8.7.4.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://patchstack.com/database/vulnerability/backupbuddy/wordpress-backup-buddy-plugin-8-5-8-0-8-7-4-1-unauthenticated-path-traversal-arbitrary-file-download-vulnerability?_s_id=cve vdb-entry
- https://ithemes.com/blog/wordpress-vulnerability-report-special-edition-september-6-2022-backupbuddy/ vendor-advisory