Description

WordPress Plugin WordPress Backup to Dropbox is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. WordPress Plugin WordPress Backup to Dropbox version 4.7.1 is vulnerable; prior versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

https://www.pluginvulnerabilities.com/2018/02/14/a-recently-closed-plugin-contains-a-vulnerability-that-allows-anyone-logged-in-to-wordpress-to-view-directory-listings/

Related Vulnerabilities

Drupal Core 8.x.x Remote Code Execution (8.0.0 - 8.3.8)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction SQL Injection (3.7.1.5)

DWR Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-5325)

Atlassian Confluence Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-22504)

WordPress Plugin Dokan-Best WooCommerce Multivendor Marketplace Solution-Build Your Own Amazon, eBay, Etsy Cross-Site Request Forgery (3.2.0)

Severity

High

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure