Description

WordPress Plugin BackupBuddy is prone to multiple vulnerabilities, including PHP object injection and cross-site request forgery vulnerabilities. A successful exploit may allow an attacker to execute arbitrary PHP code within the context of the affected webserver process or to perform certain administrative actions; other attacks are also possible. WordPress Plugin BackupBuddy version 8.0.1.8 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://www.pluginvulnerabilities.com/2017/09/08/cross-site-request-forgery-csrfphp-object-injection-vulnerability-in-backupbuddy/

Related Vulnerabilities

Joomla! Core 1.6.0 Multiple Vulnerabilities (1.6.0 - 1.6.0)

WordPress Plugin Twitter Friends Widget Cross-Site Scripting (3.1)

WordPress Plugin PixelYourSite-Facebook Pixel (Events, WooCommerce & Easy Digital Downloads) Multiple Unspecified Vulnerabilities (4.0.2)

WordPress Plugin Salon booking system Multiple Information Disclosure Vulnerabilities (7.6.2)

WordPress Plugin Instant Images-One Click Unsplash Uploads Cross-Site Scripting (4.4.0)

Severity

High

Classification

CWE-352 CWE-915 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Tags

Missing Update