PT-2024-14921 · WordPress · Backup Migration

Dmitry Ignatyev · Published 2024-01-01 · Updated 2025-06-11 · CVE-2023-6271

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Backup Migration WordPress plugin versions prior to 1.3.6

Description The issue allows attackers to potentially leak sensitive information from a site's backups by monitoring publicly accessible files that store in-progress backups information.

Recommendations For versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the publicly accessible files that store in-progress backups information to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-6271

Affected Products

Backup Migration

References · 11

• 🔥 https://wpscan.com/vulnerability/7ac217db-f332-404b-a265-6dc86fe747b9 · Exploit
• 🔥 https://research.cleantalk.org/cve-2023-6271-backup-migration-unauth-sensitive-data-exposure-to-full-control-of-the-site-poc-exploit · Exploit
• https://osv.dev/vulnerability/CVE-2023-6271 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6271 · Security Note
• https://t.me/cvenotify/65901 · Telegram Post
• https://twitter.com/CVEnew/status/1741828985997160826 · Twitter Post
• https://t.me/cvenotify/65948 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1741878776634499118 · Twitter Post
• https://t.me/cibsecurity/74091 · Telegram Post
• https://t.me/cvenotify/125401 · Telegram Post
• https://t.me/cvenotify/66629 · Telegram Post