Description

WordPress Plugin UpdraftPlus WordPress Backup is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently download backups made with the plugin. WordPress Plugin UpdraftPlus WordPress Backup versions between 1.16.7 and 1.22.3 are vulnerable.

Remediation

Update to plugin version 1.22.3 or latest

References

https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/

https://www.wordfence.com/blog/2022/02/vulnerability-in-updraftplus-allowed-subscribers-to-download-sensitive-backups/

https://updraftplus.com/updraftplus-security-release-1-22-3-2-22-3/

Related Vulnerabilities

WordPress Plugin Membership For WooCommerce-Add Simple Membership Plans, Recurring Revenue, Product Tags & Send Emails To Members with WooCommerce Membership Arbitrary File Upload (2.1.6)

WordPress Plugin WordPress Sentinel Multiple Vulnerabilities (1.0.0)

WordPress Plugin Theme Tuner 'tt-abspath' Parameter Remote File Include (0.7)

Joomla Improper Input Validation Vulnerability (CVE-2013-5576)

MyBB Improper Access Control Vulnerability (CVE-2016-9412)

Severity

High

Classification

CVE-2022-0633 CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass