by Kastro
Paper/Archive/CVE-2023-6553

CVE-2023-6553

inisev BackupBliss – Backup & Migration with Free Cloud Storage — Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

EPSS 98%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

Affected

ProductAffectedFixed inSource
BackupBliss – Backup & Migration with Free Cloud Storage≤ 1.3.7–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cverefplugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38refplugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62refplugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64refplugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118refsynacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-itrefplugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail=refpacketstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html