WordPress Plugin UpdraftPlus WordPress Backup Security Bypass (1.22.1) - Vulnerability Database

WordPress Plugin UpdraftPlus WordPress Backup Security Bypass (1.22.1)

Description

WordPress Plugin UpdraftPlus WordPress Backup is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently download backups made with the plugin. WordPress Plugin UpdraftPlus WordPress Backup versions between 1.16.7 and 1.22.3 are vulnerable.

Remediation

Update to plugin version 1.22.3 or latest

References

https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/

https://www.wordfence.com/blog/2022/02/vulnerability-in-updraftplus-allowed-subscribers-to-download-sensitive-backups/

https://updraftplus.com/updraftplus-security-release-1-22-3-2-22-3/

Related Vulnerabilities

Severity

High

Classification

CVE-2022-0633

CWE-264

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N