Migration, Backup, Staging – WPvivid, CVE-2023-4637
- CVE, Research URL
- Application
- Published on
- Feb 06, 2024
- Research Description
- The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() function in versions up to, and including, 0.9.94. This makes it possible for unauthenticated attackers to invoke these functions and obtain full file paths if they have access to a back-up ID.
- Affected versions
-
Min -, max 0.9.95.
- Status
-
vulnerable