CVE-2022-4931

MEDIO 4.3CVE-2022-4931 · Published 07/03/2023 · updated 17/06/2026

In breve

CVE-2022-4931 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda backupwordpress (xibodevelopment).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.46%, superiore al 40.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
backupwordpress xibodevelopment	`≤ 3.12`	No fix yet

Description

The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.

References

plugins.trac.wordpress.org/changeset · Patch
wordfence.com/threat-intel/vulnerabilities/id/747c86f4-118b-4a9c-899c-e9067d2c7a02 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free