CVE-2022-1577: Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1577?
CVE-2022-1577 has been assigned a medium severity rating due to the potential for CSRF attacks allowing unauthorized changes to backup settings.
How do I fix CVE-2022-1577?
To fix CVE-2022-1577, update the Database Backup for WordPress plugin to version 2.5.2 or later.
What type of attack does CVE-2022-1577 expose my site to?
CVE-2022-1577 exposes your site to CSRF attacks that can allow attackers to unauthorizedly modify scheduled backup settings.
Who is affected by CVE-2022-1577?
Any WordPress site using the Database Backup plugin versions prior to 2.5.2 is affected by CVE-2022-1577.
What actions should I take if my site is vulnerable to CVE-2022-1577?
If your site is vulnerable to CVE-2022-1577, immediately update the plugin and review your site's backup settings for any unauthorized changes.