CVE-2023-6972
Published: 23 December 2023
Summary
CVE-2023-6972 is a critical-severity Path Traversal (CWE-22) vulnerability in Backupbliss Backup Migration. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Backup Migration plugin for WordPress is vulnerable to path traversal in all versions through 1.3.9. The flaw resides in the handling of the content-backups, content-name, content-manifest, content-bmitmp, and content-identy HTTP headers within files such as backup-heart.php and bypasser.php, allowing an attacker to supply directory traversal sequences that resolve to arbitrary server paths.
Unauthenticated remote attackers can exploit the issue over the network to delete arbitrary files. Deletion of wp-config.php in particular can disable the site and enable subsequent remote code execution or full site takeover. The vulnerability carries a CVSS 3.1 score of 9.8.
Public references, including the Wordfence advisory and the plugin Trac changeset 3012745, indicate that the vendor addressed the flaw by updating the affected header-processing logic; administrators should upgrade to a release newer than 1.3.9. The current EPSS score of 0.1832 (peak 0.1903) reflects moderate but stable exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59168
Vulnerability details
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete…
more
arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.