CVE-2023-7002CWE-78

Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url

High · published December 23, 2023

CVSS v3.1
7.2
EPSS
31%
Percentile
98.3
In the wild
Unconfirmed
What it is

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.30791 · 98.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-12-23T01:59Z
EPSS history
Timeline
  • 23 DEC 01:59Z
    Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url
    cvelistv5