Backup, Restore and Migrate WordPress Sites With the XCloner Plugin, CVE-2025-11759

CVE, Research URL: CVE-2025-11759
Home page URL: Security reports for Backup, Restore and Migrate WordPress Sites With the XCloner Plugin
Application: Backup, Restore and Migrate WordPress Sites With the XCloner Plugin
Published on: Dec 05, 2025
Research Description: The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2. This is due to missing or incorrect nonce validation on the Xcloner_Remote_Storage:save() function. This makes it possible for unauthenticated attackers to add or modify an FTP backup configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows an attacker to set an attacker-controlled FTP site for backup storage and exfiltrate potentially sensitive site data.
Affected versions: max 4.8.3.
Status: vulnerable