BackWPup < 4.0.4 – Unauthenticated Backup Download | CVE 2023-7164 | Plugin Vulnerabilities

Description

The plugin does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

Proof of Concept

1) Ensure that Apache is configured with the ability to list directory content.
2) When this is done, you can see the backup directory.
3) When the backup is in progress, you can access the backup at: http://your_site/wordpress/wp-content/uploads/backwpup-{hash}-temp/db.sql

Affects Plugins

Fixed in 4.0.4

References

CVE

URL

https://research.cleantalk.org/cve-2023-7164/

Classification

Type

SENSITIVE DATA DISCLOSURE

OWASP top 10

A3: Sensitive Data Exposure

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

79b07f37-2c6b-4846-bb28-91a1e5bf112e

Timeline

Publicly Published

2023-12-18 (about 2 years ago)

Added

2024-03-18 (about 1 year ago)

Last Updated

2024-08-30 (about 1 year ago)

Other

Published

Title

Published

2022-03-30

Title

Be POPIA Compliant < 1.1.6 - Unauthenticated Sensitive Information Exposure

Published

2025-08-14

Title

EventON Lite < 2.4.8 - Authenticated (Contributor+) Information Disclosure

Published

2024-12-02

Title

WP Mailster < 1.8.17.0 - Unauthenticated Information Exposure

Published

2025-11-20

Title

LearnPress – WordPress LMS Plugin < 4.3.0 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure

Published

2025-12-04

Title

User Spam Remover <= 1.1 - Unauthenticated Information Exposure