CVE-2013-2741: High severity backupbuddy vulnerability
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2741?
CVE-2013-2741 has a moderate severity level as it allows unauthorized access to sensitive information in the BackupBuddy plugin.
How do I fix CVE-2013-2741?
To fix CVE-2013-2741, update BackupBuddy to the latest version that requires authentication for sensitive operations.
What versions of BackupBuddy are affected by CVE-2013-2741?
BackupBuddy versions 1.3.4, 2.1.4, 2.2.4, 2.2.25, and 2.2.28 are vulnerable to CVE-2013-2741.
What kind of attacks can exploit CVE-2013-2741?
CVE-2013-2741 can be exploited through direct requests to importbuddy.php to obtain sensitive data or perform unauthorized file operations.
Is WordPress affected by CVE-2013-2741?
WordPress itself is not affected by CVE-2013-2741, but the vulnerable versions of the BackupBuddy plugin can compromise installations.