Description (CNA)
The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| mywebsiteadvisor / Simple Backup | affected 0 before 2.7.11 |
CWE
CWE-22
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/29482b70-0ff2-4bb1-9d41-9cffb83b5ad0?source=cve
- https://packetstormsecurity.com/files/131919/
ADP enrichment
No English description supplied.
No references supplied.