BackWPup WordPress Plugin Missing Authorization Vulnerability Allowing Sensitive Information Exposure

A vulnerability exists in the BackWPup – WordPress Backup & Restore Plugin, in all versions through 5.5.0. The issue arises from a missing capability check on the 'backwpup_working' AJAX action, allowing authenticated attackers with Subscriber-level access and above to access the filename of a backup in progress. While this information is not particularly valuable on its own, it could facilitate a brute force attack to extract backup contents in certain environments, such as NGINX.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, specifically backup filenames of ongoing backups, which could be used to aid in accessing backup contents in some environments.

Remediation

Users are advised to update the BackWPup WordPress plugin to version 5.5.1 or a newer patched version.