CVE-2015-10134
HIGH
7.5
CVSS 3.1
Description
The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.
Affected products and versions
- mywebsiteadvisor Simple Backup — Before 2.7.11
- mywebsiteadvisor simple_backup — Up to and including 2.7.10
References
- packetstormsecurity.com https://packetstormsecurity.com/files/131919/ Exploit
- www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/29482b70-0ff2-4bb1-9d41-9cffb83b5ad0?source=cve Third Party Advisory
- nvd.nist.gov Official NVD record