PT-2025-17043 · WordPress · Webtoffee Wordpress Backup & Migration

Savphill · Published 2025-04-17 · Updated 2025-04-17 · CVE-2025-24651

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebToffee WordPress Backup & Migration versions 1.5.3 and earlier

Description The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into log files.

Recommendations For versions 1.5.3 and earlier, update to a version that fixes this issue to prevent sensitive information from being logged. As a temporary workaround, consider restricting access to log files to minimize the risk of sensitive data exposure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-24651

Affected Products

Webtoffee Wordpress Backup & Migration

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-24651 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wp-migration-duplicator/vulnerability/wordpress-webtoffee-wp-backup-and-migration-plugin-1-5-3-sensitive-data-exposure-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1912943260240420995 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-webtoffee-wp-backup-and-migration-plugin-1-5-3-sensitive-data-exposure-vulnerability?_s_id=cve · Note