PT-2021-11882 · WordPress · Xcloner Backup/Restore

Chloe Chamberland · Published 2021-01-01 · Updated 2021-01-13 · CVE-2020-35950

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: XCloner Backup and Restore plugin versions prior to 4.2.153

Description: An issue was discovered in the XCloner Backup and Restore plugin for WordPress, allowing CSRF via almost any endpoint.

Recommendations: For versions prior to 4.2.153, update to version 4.2.153 or later to resolve the issue. As a temporary workaround, consider implementing CSRF protection measures, such as validating request tokens, to minimize the risk of exploitation. Restrict access to sensitive endpoints to minimize the risk of CSRF attacks until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-35950

Affected Products

Xcloner Backup/Restore

References · 6

• 🔥 https://wordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin · Exploit
• 🔥 https://wpscan.com/vulnerability/10413 · Exploit
• https://osv.dev/vulnerability/CVE-2020-35950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35950 · Security Note
• https://t.me/cibsecurity/21504 · Telegram Post
• https://t.me/cvenotify/8077 · Telegram Post