A zero-day flaw in a WordPress plugin called BackupBuddy is being actively exploited, WordPress security company Wordfence has disclosed.

“This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information,” it said.

BackupBuddy allows users to back up their entire WordPress installation from within the dashboard, including theme files, pages, posts, widgets, users, and media files, among others.

CyberSecurity

The plugin is estimated to have around 140,000 active installations, with the flaw (CVE-2022-31474, CVSS score: 7.5) affecting versions 8.5.8.0 to 8.7.4.1. It’s been addressed in version 8.7.5 released on September 2, 2022.

The issue is rooted in the function called “Local Directory Copy” that’s designed to store a local copy of the backups. According to Wordfence, the vulnerability is the result of an insecure implementation, which enables an unauthenticated threat actor to download any arbitrary file on the server.

WordPress BackupBuddy Plugin

Additional details about the flaw have been withheld in light of active in-the-wild abuse and its ease of exploitation.

“This vulnerability could allow an attacker to view the contents of any file on your server that can be read by your WordPress installation,” the plugin’s developer, iThemes, said. “This could include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd.”

CyberSecurity

Wordfence noted that the targeting of CVE-2022-31474 commenced on August 26, 2022, and that it has blocked nearly five million attacks in the intervening time period. Most of the intrusions have attempted to read the below files –

  • /etc/passwd
  • /wp-config.php
  • .my.cnf
  • .accesshash

Users of the BackupBuddy plugin are advised to upgrade to the latest version. Should users determine that they may have been compromised, it’s recommended to reset the database password, change WordPress Salts, and rotate API keys stored in wp-config.php.

Technology

Products You May Like

Articles You May Like

Dramatic moment jet strikes bird and plummets to ground
Book Bans Impact Over 4 Million Students: PEN America’s Sobering New Report
Elton John Performs for White House, Gets Surprise Medal From President Biden
Native American accepts apology from Oscars after abuse in 1973
PM going for broke in hope of winning big – but has she misjudged the public mood? | Beth Rigby

Leave a Reply

Your email address will not be published.