CVE-2024-2294mediumCWE-22

CVE-2024-2294: falha de média gravidade em softaculous Backuply – Backup, Restore…

Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Backuply – Backup, Restore, Migrate and Clone

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.9epss 0.9%
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
softaculous · Backuply – Backup, Restore, Migrate and Clone
CVEs relacionadas — softaculous Backuply – Backup, Restore…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-8669CRITICALBackuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL InjectionEPSS 16.6%CVE-2024-0842HIGHBackuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of ServiceEPSS 1.0%CVE-2024-0697MEDIUMBackuply – Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory TraversalEPSS 0.8%CVE-2025-10307MEDIUMBackuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File DeletionEPSS 0.7%CVE-2026-93953HIGHBackuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege EscalationEPSS 0.3%