CVE-2023-5737: Missing Authorization

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings...

CVE-2023-5738: Improper Neutralization of Input During Web Page Generation

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks...

Backup Migration < 1.3.0 - Cross-Site Request Forgery

Description The Backup Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9. This is due to missing nonce validation on the ajax function, or BMIAjax class. This makes it possible for unauthenticated attackers to control any of the...

WordPress Backup & Migration < 1.4.2 - Missing Authorization to Settings and Schedule Modification

Description The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wtsavesettings and saveschedule functions in versions up to, and including, 1.4.1. This makes it possible for authenticated attackers, with...

WordPress WordPress Backup & Migration Plugin < 1.4.5 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Backup & Migration Type Plugin Vulnerable versions 1.4.5 Fixed in 1.4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5738 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9b9d4e9b2aa2 Credits Krzyszt...

CVE-2023-5982: Cross-Site Request Forgery (CSRF)

The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instanceid on the 'updraftmethod-googledrive-auth' acti...

WordPress WordPress Backup & Migration Plugin <= 1.4.1 is vulnerable to Broken Access Control

Software WordPress Backup & Migration Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-45636 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID e1fb36cf7cf2 Credits Abdi Prana...

WordPress Backup Migration Plugin < 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Backup Migration Type Plugin Vulnerable versions 1.3.0 Fixed in 1.3.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f9d3ed26dda6 Credits Unknown Required privilege...

WordPress Backup Migration Plugin <= 1.2.7 is vulnerable to Broken Access Control

Software Backup Migration Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c3aab82cdff1 Credits WordFence Required privilege...

WordPress Backup Migration Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Backup Migration Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ce79e63ce100 Credits Wordfence Required...

WordPress Backup Migration 1.2.8 Backup Disclosure

Exploit Title: WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup Google Dork: intitle:"Index of /wp-content/plugins/backup-backup" AND inurl:"plugins/backup-backup/" Date: 2023-05-10 Exploit Author: Wadeek Vendor Homepage: https://backupbliss.com/ Software Link:...

WordPress WordPress Backup & Migration Plugin <= 1.4.0 is vulnerable to Broken Access Control

Software WordPress Backup & Migration Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33928 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2b2189b8e277 Credits Abdi Pranata...

WordPress Backup Migration 1.2.8 Plugin - Unauthenticated Database Backup Vulnerability

Exploit Title: WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup Google Dork: intitle:"Index of /wp-content/plugins/backup-backup" AND inurl:"plugins/backup-backup/" Exploit Author: Wadeek Vendor Homepage: https://backupbliss.com/ Software Link:...

WordPress plugin Migration, Backup, Staging 路径遍历漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress WPvivid Backup and Migration plugin version 0.9.70 and previous versions contain an arbitrary file read vulnerability. An...

CVE-2021-36884

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered in WordPress Backup Migration plugin = 1.1.5 versions...

CVE-2021-36884

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered in WordPress Backup Migration plugin = 1.1.5 versions...

Cross site scripting

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered in WordPress Backup Migration plugin = 1.1.5 versions...

CVE-2021-36884

The CVE-2021-36884 entry concerns the WordPress Backup Migration plugin for WordPress, affected in versions up to 1.1.5. Affected component is the plugin’s settings handling, where insufficient sanitisation/escaping allows an authenticated user to perform a persistent XSS attack (stored in the co...

CVE-2021-36884 WordPress Backup Migration plugin <= 1.1.5 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered in WordPress Backup Migration plugin = 1.1.5 versions...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Backup Migration, which stems from an...