Cyber Resilience

CVE-2023-7164

HighPublic PoC

Published: 08 April 2024

Published
08 April 2024
Modified
11 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.2604 96.4th percentile
Risk Priority 31 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-7164 is a high-severity an unspecified weakness vulnerability in Inpsyde Backwpup. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The BackWPup WordPress plugin before version 4.0.4 contains a vulnerability in which its temporary backup folder permits directory listing. This flaw allows unauthenticated remote attackers to enumerate and retrieve database backup files stored in that location, exposing sensitive site data. The issue carries a CVSS 3.1 score of 7.5, reflecting network attack vector, low complexity, and high confidentiality impact without requiring privileges or user interaction.

An attacker can simply browse the publicly accessible backup directory to download complete database archives, potentially obtaining credentials, user information, and other site contents. Because the plugin is widely used for WordPress backups, any installation that has not been updated remains exposed to this information disclosure risk.

Public references from WPScan detail the directory-listing weakness and indicate that upgrading to BackWPup 4.0.4 or later addresses the exposure by preventing such enumeration. The EPSS score rose from a low baseline to a peak of 0.3538, signaling increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Why these techniques?

The vulnerability enables unauthenticated directory listing and direct download of database backups via a public-facing WordPress plugin, facilitating initial access through exploitation of public-facing applications (T1190), collection of data from databases (T1213.006), and access to unsecured credentials in files such as user hashes in the database dump (T1552.001).

Affected Assets

inpsyde
backwpup
≤ 4.0.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References