FastDup WordPress Plugin Missing Authorization Vulnerability in Backup Creation and Download

A vulnerability exists in the FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress, specifically in versions through 2.7.1. The issue arises from a lack of proper capability checks on REST API endpoints, allowing authenticated attackers with Contributor-level access and above to create and download full-site backup archives. These backups include the entire WordPress installation, database exports, and configuration files.

Impact

Exploitation of this vulnerability allows for unauthorized backup creation and download, giving access to sensitive site data, including database contents and configuration files.

Remediation

Users are advised to update the FastDup WordPress plugin to version 2.7.2 or a newer patched version.