CVE-2023-5504: BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5504?
CVE-2023-5504 is classified as a medium severity vulnerability due to its potential impact on server security.
How do I fix CVE-2023-5504?
To fix CVE-2023-5504, update the BackWPup plugin to version 4.0.2 or later.
What type of vulnerability is CVE-2023-5504?
CVE-2023-5504 is a Directory Traversal vulnerability that allows unauthorized file access.
Who is affected by CVE-2023-5504?
CVE-2023-5504 affects users of the BackWPup plugin for WordPress versions up to and including 4.0.1.
Can CVE-2023-5504 be exploited remotely?
No, CVE-2023-5504 can only be exploited by authenticated attackers who have access to the WordPress site.