CVE-2023-6266 Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
Unauthenticated attackers can download backup files containing sensitive data due to insufficient path validation in the Backup Migration plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6266?
CVE-2023-6266 is a high-severity path traversal vulnerability in inisev BackupBliss – Backup & Migration with Free Cloud Storage, published on 11 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.
Which versions are affected by CVE-2023-6266?
It affects 1 product.
Products include Backupbliss Backup Migration.
How do I fix CVE-2023-6266?
No fix has been published for CVE-2023-6266 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-6266 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6266 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in inisev BackupBliss – Backup & Migration with Free Cloud Storage
- CVE-2023-6972 Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
- CVE-2023-6553 Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
- CVE-2023-6971 Code injection in Backup Migration
- CVE-2023-6271 Backup Migration Staging < 1.3.6 - Sensitive Data Exposure
- CVE-2023-7002 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url
Sources
Also known as GHSA-wqc2-2gpx-6j9r.