CVE-2023-5775 BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password

What is CVE-2023-5775?

CVE-2023-5775 is a low-severity vulnerability in wp_media BackWPup – WordPress Backup & Restore Plugin, published on 24 Feb 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with administrator-level access, to retrieve the password from the password input field in the UI or from the options table where the password is stored.

Weakness: CWE-256

Which versions are affected by CVE-2023-5775?

It affects 1 product.

Products include Inpsyde Backwpup.

How do I fix CVE-2023-5775?

No fix has been published for CVE-2023-5775 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-5775 being exploited?

There is no known exploitation of CVE-2023-5775 in the wild and no public exploit code.

Other vulnerabilities in wp_media BackWPup – WordPress Backup & Restore Plugin

• CVE-2023-5504 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal High 8.7
• CVE-2023-7164 BackWPup < 4.0.4 - Unauthenticated Backup Download High 7.5
• CVE-2017-2551 Information disclosure in backwpup High 7.5
• CVE-2023-5505 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vqx3-p34h-gjh5.