CVE-2024-13911
Published: 01 March 2025
Summary
CVE-2024-13911 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13911 is a sensitive information exposure vulnerability (CWE-200) affecting the Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress in all versions up to and including 2.35. The issue resides in the /dashboard/backup.php file, where sensitive data, including full database credentials, can be extracted. It has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
Authenticated attackers with Administrator-level access or higher can exploit this vulnerability remotely without user interaction. By accessing the vulnerable /dashboard/backup.php endpoint, they can retrieve exposed sensitive information such as complete database credentials, potentially enabling further compromise of the WordPress site's backend database.
The provided references point to specific lines (62-66) in the plugin's trunk/dashboard/backup.php file on the WordPress plugin trac repository, highlighting the exact location of the exposure in the source code. No additional advisory details on patches or mitigations are specified beyond identifying the vulnerable versions up to 2.35.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5887
Vulnerability details
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level…
more
access and above, to extract sensitive data including full database credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly exposes database credentials in a web-accessible file on a public-facing WordPress plugin, enabling exploitation via T1190 and credential retrieval from files via T1552.001.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring identification, reporting, and remediation of the flaw exposing database credentials in the plugin's backup.php file.
Prevents sensitive database credentials from being exposed by filtering information output from the vulnerable /dashboard/backup.php endpoint.
Monitors the system for unauthorized disclosures of sensitive information, such as database credentials extracted via the plugin's vulnerable file.