Xagio SEO WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Xagio SEO plugin for WordPress, affecting all versions through 7.1.0.5. The issue arises from the backup functionality, which lacks proper filename structure and directory protection. This vulnerability enables unauthenticated attackers to access sensitive data from backups, potentially including the entire database and site files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, including database contents and site files.

Reproduction

The vulnerability can be reproduced by accessing the backup files created by the Xagio SEO plugin. These files can be retrieved from unprotected directories, as the plugin does not adequately secure backup locations or file names, allowing for unauthorized access.

Remediation

Users are advised to update the Xagio SEO plugin to version 7.1.0.6 or later.