Vulnerability Details : CVE-2022-0633
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
Products affected by CVE-2022-0633
- cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:premium:wordpress:*:*
- cpe:2.3:a:updraftplus:updraftplus:*:*:*:*:free:wordpress:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-0633
0.46%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 75 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-0633
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2022-0633
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.Assigned by:
- contact@wpscan.com (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2022-0633
-
http://packetstormsecurity.com/files/166059/WordPress-UpdraftPlus-1.22.2-Backup-Disclosure.html
WordPress UpdraftPlus 1.22.2 Backup Disclosure ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://wpscan.com/vulnerability/d257c28f-3c7e-422b-a5c2-e618ed3c0bf3
Attention Required! | CloudflareThird Party Advisory
-
https://updraftplus.com/updraftplus-security-release-1-22-3-2-22-3/
UpdraftPlus security release - 1.22.3 / 2.22.3 - please upgrade - UpdraftPlusRelease Notes;Vendor Advisory
-
https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/
Severe Vulnerability Fixed In UpdraftPlus 1.22.3Exploit;Third Party Advisory
Jump to