CVE-2024-12330
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-12330 is a high-severity Exposure of Backup File to an Unauthorized Control Sphere (CWE-530) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-12330 is a sensitive information exposure vulnerability (CWE-530) affecting the WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress, in all versions up to and including 7.3. The issue stems from publicly accessible backup files, which expose all information stored in the database. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for privileges or user interaction.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity by directly accessing the publicly exposed backup files. Successful exploitation allows extraction of sensitive data, including the entire database contents, potentially encompassing user credentials, personal information, and other confidential site data.
Advisories from Wordfence and WordPress plugin trac repositories detail mitigation through updating the plugin, with fix commits available in changesets 3209380 and 3209387. Security practitioners should verify installations of the plugin, ensure backups are not publicly accessible, and apply updates immediately to versions beyond 7.3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50777
Vulnerability Data
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible…
more
for unauthenticated attackers to extract sensitive data including all information stored in the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorization checks on all logical access, directly stopping unauthorized actors from reaching backup files.
Explicitly restricts access to removable or backup media to authorized personnel only.
Limits privileges so that only the minimal set of users can access backup locations or archives.
Requires physical and logical controls plus encryption or access restrictions when storing backup media.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit requirement to protect backups directly mitigates unauthorized exposure of backup files.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Classification helps identify which backups need stricter handling, but does not enforce storage location or access restrictions.
Access control directly limits who can reach backup files, though it does not address how backups are created or stored.
A.5.18's provisioning, revocation, review and adjustment of logical access rights (incl. before/after role changes or termination) directly stops unauthorized actors from reaching the backup file per business/policy rules; the bounded remainder is backups whose exposure is not an access-rights decision at all (e.g. the file is world-readable on a public share with no identity check).
Storage-media controls govern where and how backups are physically or logically stored, directly mitigating exposure.
A.8.13 mandates secure remote storage, physical/environmental protection, encryption per risks, and access-consistent safeguards for backups; this stops most unauthorized exposure of backup files (the core of CWE-530) but leaves a bounded remainder (e.g. misconfigured cloud-provider access controls or restoration-test leakage not covered by the backup clause itself).