BackWPup < 4.0.4 - Unauthenticated Backup Download
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 2.3%
exploitation probability
2.3%top 19% of all CVEs
observed exploitation
nono source reports it
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · BackWPup