WordPress Plugin Vulnerabilities

WP Database Backup < 7.4 - Unauthenticated Database Back-Up Exposure

Description

The plugin is vulnerable to Sensitive Information Exposure via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.

Affects Plugins

Plugin icon
wp-database-backup
Fixed in 7.4

References

CVE
CVE-2024-12330
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3f36839b-850e-4c39-aa61-4fd7a89cd5bc

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Noah Stead (TurtleBurg)
Verified
No
WPVDB ID
0e6d1f3e-07c3-4901-b733-a795fb61b661

Timeline

Publicly Published
2025-01-08 (about 1 year ago)
Added
2025-01-13 (about 1 year ago)
Last Updated
2025-01-13 (about 1 year ago)

Other

Published
Title
Published
2025-12-04
Title
Google Analytics Events <= 2.8.2 - Unauthenticated Information Exposure
Published
2024-12-02
Title
WP Mailster < 1.8.17.0 - Unauthenticated Information Exposure
Published
2020-07-30
Title
JetBackup < 1.4.1 - Subscriber+ Sensitive Information Disclosure
Published
2021-09-14
Title
Jetpack CRM WooCommerce Connect < 2.13 - Unauthorized Invoice Disclosure
Published
2026-01-22
Title
Contact Form 7 GetResponse Extension <= 1.0.8 - Unauthenticated Information Exposure