CVE-2023-6972CWE-22

Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion

Critical · published December 23, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
71.7
In the wild
Unconfirmed
What it is

The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01379 · 71.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-12-23T01:59Z
EPSS history
Timeline
  • 23 DEC 01:59Z
    Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
    cvelistv5