CVE-2023-7232 Backup and Restore WordPress <= 1.45 - Unauthenticated Sensitive Data Exposure

Q: What is CVE-2023-7232?

CVE-2023-7232 is a medium-severity vulnerability in Unknown Backup and Restore WordPress , published on 26 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2023-7232 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7232 exists.

Q: How do I fix CVE-2023-7232?

No fix has been published for CVE-2023-7232 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 26 Mar 2024 Updated 2 Aug 2024

Unauthenticated attackers can access sensitive log files containing site configuration data in the Backup and Restore WordPress plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-7232?

CVE-2023-7232 is a medium-severity vulnerability in Unknown Backup and Restore WordPress , published on 26 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data

Which versions are affected by CVE-2023-7232?

It affects 1 product.

Products include Wpbackitup Backup and Restore Wordpress.

How do I fix CVE-2023-7232?

No fix has been published for CVE-2023-7232 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-7232 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7232 exists.

CVE-2024-43269 WordPress Backup and Restore WordPress plugin <= 1.50 - Cross Site Request Forgery (CSRF) vulnerability Medium 4.3

Sources

Also known as GHSA-qr4g-jhmq-xw23.