PT-2024-36699 · WordPress · Wp Superbackup

Dave Jong · Published 2024-12-31 · Updated 2025-01-27 · CVE-2024-56064

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP SuperBackup versions 2.3.3 and earlier

Description The issue affects the WP SuperBackup plugin for WordPress, allowing unrestricted upload of files with dangerous types. This enables attackers to upload a web shell to a web server. The vulnerability is due to missing file type validation in all versions up to and including 2.3.3.

Recommendations For WP SuperBackup versions 2.3.3 and earlier, update to version 2.3.4 to patch this issue. As a temporary workaround, consider restricting access to the file upload functionality until the update is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-56064

Affected Products

Wp Superbackup

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-56064 · Security Note
• https://t.me/latest_high_impact_cve/1739 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1874193918243250284 · Twitter Post
• https://twitter.com/CveFindCom/status/1874078506465841372 · Twitter Post
• https://twitter.com/bluepinksec/status/1874958162610004171 · Twitter Post
• https://twitter.com/y1659rsgh/status/1883752310834077771 · Twitter Post
• https://twitter.com/CVEnew/status/1874083001174544795 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/indeed-wp-superbackup/vulnerability/wordpress-wp-superbackup-plugin-2-3-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/indeed-wp-superbackup/vulnerability/wordpress-wp-superbackup-plugin-2-3-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/14006 · Telegram Post