VulnerabilityModified
CVE-2022-2863
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
MEDIUM 4.9EPSS 20.7%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 20.7%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 20.67% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- wpvivid/migration\, backup\, staging
- Source
- contact@wpscan.com
References
- http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2022/Oct/0Exploit, Mailing List, Third Party Advisory
- https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5Exploit, Patch, Third Party Advisory
- http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2022/Oct/0Exploit, Mailing List, Third Party Advisory
- https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.