WP Database Backup Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress, affecting all versions through 7.3. The vulnerability arises from publicly accessible backup files, which unauthenticated attackers can exploit to access sensitive data, including all information stored in the database.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive database information.

Reproduction

The vulnerability can be reproduced by accessing the publicly available backup files created by the WP Database Backup plugin. These files can be downloaded without authentication, allowing anyone to retrieve the database contents.

Remediation

Users are advised to update the WP Database Backup plugin to version 7.4 or later.