CVE-2023-7164

BackWPup < 4.0.4 - Unauthenticated Backup Download

High · published April 8, 2024

CVSS v3.1
7.5
EPSS
2%
Percentile
82.7
In the wild
Unconfirmed
What it is

The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02242 · 82.7th percentile
Published
2024-04-08T17:28Z
EPSS history
Timeline
  • 08 APR 17:28Z
    BackWPup < 4.0.4 - Unauthenticated Backup Download
    cvelistv5