CVE-2023-6971

Katalog CVE

CVSS 9.8 · Critical EPSS 6,4%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada backupbliss backup migration. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

Rincian

Terbit di NVD

23 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

6,4% peluang dieksploitasi; lebih tinggi dari 93,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php patch
• https://plugins.trac.wordpress.org/changeset/3012745/backup-backup patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve patch · advisory pihak ketiga