CVE-2020-35948
53Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 9.9epss 25%
da publicação à arma181 dias
Publicada no NVD1 de jan.
1ª PoC+181d
probabilidade de exploração
25%top 2% das CVEs
exploração observada
nãonenhuma fonte reporta
2 exploit(s) público(s)
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
Produtos afetados
n/a · n/aPoCs públicas encontradas — 2
exploitdbwww.exploit-db.com/exploits/50077não verificadocve_referencepacketstormsecurity.com/files/163336/WordPress-XCloner-4.2.12-Remote-Code-Execution.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/163336/WordPress-XCloner-4.2.12-Remote-Code-Execution.htmlhttps://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2020-35948https://wpscan.com/vulnerability/10412https://www.wordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin/