Paper/Archive/CVE-2020-35948

CVE-2020-35948

mitre — An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress.

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 97.9.979 × 2019.6 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

mitre (CNA)9.9CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

References

refwordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin refwpscan.com/vulnerability/10412 refpacketstormsecurity.com/files/163336/WordPress-XCloner-4.2.12-Remote-Code-Execution.html refgithub.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2020-35948