Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Wordpress Plugin Backup Migration Inclusion of Functionality from Untrusted Control Sphere Vulnerability - CVE-2023-6971 - Vulnerability Database
Wordpress Plugin Backup Migration

Wordpress Plugin Backup Migration Inclusion of Functionality from Untrusted Control Sphere Vulnerability - CVE-2023-6971

Critical
Reference: CVE-2023-6971
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2023-6971
Title: Wordpress Plugin Backup Migration Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Overview:

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 39content-dir39 HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server39s php.ini is configured with 39allow_url_include39 set to 39on39. This feature is deprecated as of PHP 7.4 and is disabled by default but can still be explicitly enabled in later versions of PHP.