PT-2025-9163 · WordPress · Database Backup/Check Tables Automated With Scheduler 2024

Dzmitry Sviatlichny + 1 · Published 2025-03-01 · Updated 2025-03-06 · CVE-2024-13911

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress versions up to and including 2.35

Description The issue allows authenticated attackers with Administrator-level access and above to extract sensitive data, including full database credentials, via the "dashboard/backup.php" file.

Recommendations For versions up to and including 2.35, consider restricting access to the /dashboard/backup.php file until a patch is available. As a temporary workaround, limit Administrator-level access to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-13911

Affected Products

Database Backup/Check Tables Automated With Scheduler 2024

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-13911 · Security Note
• https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L64 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c548b70a-8566-4aaf-a3a2-fce6c19e6a0c?source=cve · Note
• https://twitter.com/cybercronai/status/1896100776172204113 · Twitter Post
• https://t.me/cvenotify/112976 · Telegram Post
• https://twitter.com/cracbot/status/1897603145444024679 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1895761871170383884 · Twitter Post
• https://twitter.com/CVEnew/status/1895981991763521696 · Twitter Post
• https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L65 · Note
• https://twitter.com/vulns_space/status/1895757726044635322 · Twitter Post
• https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L62 · Note
• https://plugins.trac.wordpress.org/changeset/3247917 · Note
• https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L66 · Note
• https://t.me/cvedetector/19222 · Telegram Post
• https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L63 · Note