PT-2024-10038 · WordPress · Super Backup & Clone - Migrate

Tonn · Published 2024-09-27 · Updated 2024-12-24 · CVE-2024-9290

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Super Backup & Clone - Migrate plugin for WordPress versions prior to 2.3.4

Description The issue is related to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk restore migrate check() function. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 to fix this issue. As a temporary workaround, consider disabling the ibk restore migrate check() function until a patch is available. Restrict access to the plugin's file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-00174

CVE-2024-9290

Affected Products

Super Backup & Clone - Migrate

References · 13

• https://bdu.fstec.ru/vul/2025-00174 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-9290 · Security Note
• https://twitter.com/VulmonFeeds/status/1867603124271149286 · Twitter Post
• https://twitter.com/DarkWebInformer/status/1871638992275620346 · Twitter Post
• https://t.me/cvedetector/12853 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7c31d9b3-38b1-49a1-b361-ffe97e02bff0?source=cve · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/indeed-wp-superbackup/super-backup-clone-migrate-for-wordpress-233-unauthenticated-arbitrary-file-upload · Note
• https://vuldb.com/?id.288230 · Note
• https://twitter.com/CveFindCom/status/1867502479564284273 · Twitter Post
• https://codecanyon.net/item/super-backup-clone-migrate-for-wordpress/12943030 · Note
• https://t.me/latest_high_impact_cve/1647 · Telegram Post
• https://t.me/thedarkwebinformer/9481 · Telegram Post
• https://twitter.com/CVEnew/status/1867537592268320994 · Twitter Post