Design/Logic Flaw

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of...

Command injection

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operati...

Path traversal

The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to...

CVE-2023-7002

CVE-2023-7002 affects the WordPress plugin Backup Migration (backup-backup). It enables OS Command Injection via the url parameter in versions up to 1.3.9. Exploitation requires administrator-level privileges or higher, allowing arbitrary commands to run on the host. Current connected data indica...

CVE-2023-7002 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operati...

CVE-2023-6971

The Backup Migration plugin for WordPress (versions 1.0.8–1.3.9) is affected by CVE-2023-6971 due to a Remote File Inclusion via the content-dir header, enabling unauthenticated code execution when PHP is configured with allow_url_include=-on. The issue is exploitable under specific PHP configura...

CVE-2023-6972 Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion

The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to...

CVE-2023-6972

CVE-2023-6972 applies to the Backup Migration plugin for WordPress, vulnerable in all versions up to 1.3.9. The root cause is a path traversal vulnerability exploitable via the content-backups, content-name, content-manifest, content-bmitmp, and content-identy HTTP headers, enabling an unauthenti...

WordPress plugin Backup Migration security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-6971: Inclusion of Functionality from Untrusted Control Sphere

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of...

CVE-2023-7002: Improper Neutralization of Special Elements used in an OS Command

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operati...

CVE-2023-6972: Improper Limitation of a Pathname to a Restricted Directory

The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to...

WordPress plugin Backup Migration security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Backup Migration security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2023-32829

Name of the Vulnerable Software and Affected Versions Backup Migration plugin for WordPress versions up to, and including, 1.3.9 Description The issue allows unauthenticated attackers to perform Path Traversal via the content-backups and content-name, content-manifest, or content-bmitmp and...

Unified Automation UaGateway NodeManagerOpcUa Object Handler Code Execution

The vulnerability of the NodeManagerOpcUa object handler in the Unified Automation UaGateway migration software lies in the possibility of exploiting memory after it is released. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2023-32835

Name of the Vulnerable Software and Affected Versions Backup Migration plugin for WordPress versions up to, and including, 1.3.9 Description The issue allows authenticated attackers with administrator-level permissions and above to execute arbitrary commands on the host operating system via the u...

PT-2023-32828 · WordPress +1 · Backup Migration +1

Name of the Vulnerable Software and Affected Versions: Backup Migration plugin for WordPress versions 1.0.8 through 1.3.9 Description: The issue allows unauthenticated attackers to include remote files on the server, resulting in code execution, via the content-dir HTTP header. Successful...

Backup Migration Plugin Code Execution

The vulnerability of the Backup Migration plugin of the WordPress content management system is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Delisted wLp still could be used for collateralization by changing position mode

Lines of code Vulnerability details Protocol governor address has the power to whitelist and delist wLp addresses using the ConfigsetWhitelistedWLps function. Only whitelisted wLp tokens are allowed to collateralize and de-collateralize users' positions: File: InitCore.sol 244: function...