Description

WordPress Plugin BackupBuddy is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. WordPress Plugin BackupBuddy version 2.2.28 is vulnerable; other versions may also be affected.

Remediation

Make sure that the file 'importbuddy.php' is removed from the root of the website

References

http://packetstormsecurity.com/files/120923/Backupbuddy-2.2.4-Sensitive-Data-Exposure.html

http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html

Related Vulnerabilities

WordPress Plugin Wordpress Forms Multiple Vulnerabilities (0.2.7.1)

WordPress Plugin Translate WordPress-Google Language Translator Cross-Site Scripting (4.0.9)

WordPress Plugin Social Auto Poster includes Backdoor [Only if downloaded via the vendor website] (2.1.3)

b2evolution Use of Insufficiently Random Values Vulnerability (CVE-2022-30935)

WordPress Plugin WordPress Infinite Scroll-Ajax Load More Multiple Vulnerabilities (5.5.3)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure CWE-200 CVE-2013-2743 CVE-2013-2744