WordPress WP Backup Plus Plugin Arbitrary File Download Vulnerabilitiy

Bugtraq ID:	68825
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 20 2014 12:00AM
Updated:	Jul 20 2014 12:00AM
Credit:	pSyCh0_3D
Vulnerable:	WP Backup Plus WP Backup Plus 0
Not Vulnerable:

WordPress WP Backup Plus Plugin Arbitrary File Download Vulnerabilitiy

The WP Backup Plus Plugin for WordPress is prone to an arbitrary-file-download vulnerability.

An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information.

WordPress WP Backup Plus Plugin Arbitrary File Download Vulnerabilitiy

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/wp-content/uploads/wp-backup-plus/

http://www.example.com/wp-content/uploads/wp-backup-plus/temp

WordPress WP Backup Plus Plugin Arbitrary File Download Vulnerabilitiy

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WordPress WP Backup Plus Plugin Arbitrary File Download Vulnerabilitiy

References:

• WP Backup Plus - Homepage (WP Backup Plus)