Vulnerabilities

TI-2023-05068 CVE-2023-5505 · GHSA-w8jq-x49j-99g5

BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

LOW 32

The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00981 Published 2024-08-17 No fix listed CWE-22

TI-2023-06551 CVE-2023-7164 · GHSA-4v53-9g52-rm7v

BackWPup < 4.0.4 - Unauthenticated Backup Download

MEDIUM 43

The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02242 Published 2024-04-08 Fixed in 4.0.4

TI-2023-05312 CVE-2023-5775 · GHSA-vqx3-p34h-gjh5

BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password

LOW 14

The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00449 Published 2024-02-24 No fix listed CWE-256

TI-2023-05067 CVE-2023-5504 · GHSA-mh4j-2c4w-jxfr

BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

LOW 39

The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00918 Published 2024-01-11 No fix listed CWE-22

TI-2021-07349 CVE-2021-25071 · GHSA-6h3h-vvg4-9qcw

Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting

LOW 29

The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-03-28 No fix listed CWE-79

TI-2017-01830 CVE-2017-2551 · GHSA-c7fc-jfqx-cmfh

Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.

LOW 36

Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01671 Published 2017-09-27 Fixed in 3.4.1 CWE-552

Vulnerabilities

Filters

BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

BackWPup < 4.0.4 - Unauthenticated Backup Download

BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password

BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting

Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.