Description
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
inisev BackupBliss – Backup & Migration with Free Cloud Storage
Default version status: unaffected
0 to ≤ 1.3.9affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0a3ae696-f67d-4ed2-b307-d2f36b6f188c?source=cve ↗
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php ↗
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/bypasser.php ↗
- https://plugins.trac.wordpress.org/changeset/3012745/backup-backup ↗