CVE-2024-13911

High

Published: 01 March 2025

Published

01 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0020 41.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13911 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, ranked at the 41.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the vulnerability by requiring identification, reporting, and remediation of the flaw exposing database credentials in the plugin's backup.php file.

SI-15 Information Output Filtering good match

prevent

Prevents sensitive database credentials from being exposed by filtering information output from the vulnerable /dashboard/backup.php endpoint.

AU-13 Monitoring for Information Disclosure good match

detect

Monitors the system for unauthorized disclosures of sensitive information, such as database credentials extracted via the plugin's vulnerable file.

NVD Description

The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level…

access and above, to extract sensitive data including full database credentials.

Deeper analysisAI

CVE-2024-13911 is a sensitive information exposure vulnerability (CWE-200) affecting the Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress in all versions up to and including 2.35. The issue resides in the /dashboard/backup.php file, where sensitive data, including full database credentials, can be extracted. It has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

Authenticated attackers with Administrator-level access or higher can exploit this vulnerability remotely without user interaction. By accessing the vulnerable /dashboard/backup.php endpoint, they can retrieve exposed sensitive information such as complete database credentials, potentially enabling further compromise of the WordPress site's backend database.

The provided references point to specific lines (62-66) in the plugin's trunk/dashboard/backup.php file on the WordPress plugin trac repository, highlighting the exact location of the exposure in the source code. No additional advisory details on patches or mitigations are specified beyond identifying the vulnerable versions up to 2.35.