BackWPup < 4.0.4 - Unauthenticated Backup Download

2024-03-1800:00:00

Dmitrii Ignatyev

apache configuration

directory listing

backup directory

unauthenticated access

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not prevent visitors from leaking key information about ongoing backups, allowing unauthenticated attackers to download backups of a site’s database.

1) Ensure that Apache is configured with the ability to list directory content.
2) When this is done, you can see the backup directory.
3) When the backup is in progress, you can access the backup at: http://your_site/wordpress/wp-content/uploads/backwpup-{hash}-temp/db.sql