CVE-2023-5505: BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5505?
CVE-2023-5505 is considered a medium-severity vulnerability due to the potential for unauthorized file storage.
How do I fix CVE-2023-5505?
To fix CVE-2023-5505, upgrade to BackWPup version 4.0.2 or newer, which addresses the directory traversal issue.
Who is affected by CVE-2023-5505?
CVE-2023-5505 affects users of BackWPup plugin for WordPress versions 4.0.1 and earlier.
What is the impact of CVE-2023-5505?
The impact of CVE-2023-5505 allows authenticated users to exploit directory traversal to write backups to arbitrary server locations.
Is my WordPress installation safe if I am using versions prior to 4.0.2 and BackWPup?
If you are using BackWPup versions prior to 4.0.2, your WordPress installation is vulnerable to exploitation through CVE-2023-5505.