PT-2024-15218 · WordPress · Jetbackup

Dmitry Ignatyev · Published 2024-02-27 · Updated 2026-04-09 · CVE-2023-7165

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBackup WordPress plugin versions prior to 2.0.9.9

Description The issue allows malicious actors to leak backup files due to the plugin not using index files to prevent public directory listing of sensitive directories in certain configurations.

Recommendations For versions prior to 2.0.9.9, update to version 2.0.9.9 or later to resolve the issue. As a temporary workaround, consider configuring the server to prevent public directory listing of sensitive directories until the plugin is updated.

Exploit

Fix

Related Identifiers

CVE-2023-7165

Affected Products

Jetbackup

References · 8

• 🔥 https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7165 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7165 · Vendor Advisory
• https://t.me/cvenotify/120493 · Telegram Post
• https://t.me/cvenotify/90047 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2042165652019118571 · Twitter Post
• https://t.me/cvenotify/72424 · Telegram Post
• https://twitter.com/CVEnew/status/1762396817147215975 · Twitter Post