Migration, Backup, Staging – WPvivid < 0.9.106 – Unauthenticated Sensitive Data Exposure | CVE 2024-7315 | Plugin Vulnerabilities

Description

The plugin does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups.

Proof of Concept

1. Run a backup
2. Note that the backup zip file exists at the location `wp-content/wpvividbackups/original-stone-parakeet.jurassic.ninja_wpvivid-[HEX_TIMESTAMP]_[YEAR]-[MONTH]-[DAY]-[HOUR]-[MINUTE]_backup_all.zip`
3. Note that the hex timestamp is a concatenation of the timestamp in seconds and a number of microseconds between 0 and 999,999. With a rough idea of when the backup was performed, an attacker could bruteforce the exact timestamp and recover the backup zip file.

Affects Plugins

wpvivid-backuprestore

Fixed in 0.9.106

References

CVE

URL

https://research.cleantalk.org/cve-2024-7315/

YouTube Video

Classification

Type

SENSITIVE DATA DISCLOSURE

OWASP top 10

A3: Sensitive Data Exposure

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

456b728b-a451-4afb-895f-850ddc4fb589

Timeline

Publicly Published

2024-09-11 (about 1 year ago)

Added

2024-09-11 (about 1 year ago)

Last Updated

2024-09-11 (about 1 year ago)

Other

Published

Title

Published

2024-06-20

Title

affiliate-toolkit < 3.4.5 - Unauthenticated Sensitive Information Exposure via Logs

Published

2025-08-17

Title

IDonatePro <= 2.1.9 - Authenticated (Subscriber+) Information Exposure

Published

2025-11-26

Title

eRoom < 1.5.7 - Unauthenticated Information Exposure

Published

2025-02-27

Title

Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

Published

2025-12-11

Title

WP Recipe Maker < 10.2.3 - Insecure Direct Object Reference to Sensitive Information Exposure