XCloner Backup and Restore WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the XCloner Backup and Restore WordPress plugin, affecting all versions through 4.8.2. The issue arises from inadequate nonce validation in the Xcloner_Remote_Storage:save() function, allowing unauthenticated attackers to manipulate FTP backup configurations. Exploitation requires tricking a site administrator into clicking a link, which could lead to the exfiltration of sensitive site data by redirecting backups to an attacker-controlled FTP site.

Impact

Exploitation of this vulnerability could result in unauthorized modification of FTP backup settings, allowing attackers to redirect backups to a location of their choice and potentially access sensitive site information.

Remediation

Users are advised to update the XCloner Backup and Restore plugin to version 4.8.3 or later.