7.5Yüksek

CVE-2023-7165JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

JetBackup; jetbackup jetbackup Yayım: 2024-02-27 11:30 (2 yıl önce)

Açıklama

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.

Zayıflık türü (CWE): CWE-200

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
jetbackup	jetbackup	< 2.0.9.9
—	JetBackup	< 2.0.9.9

Kaynaklar ve yamalar

https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/ exploitvdb-entrytechnical-description

CVSS puanı

7.5Yüksek

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yok
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30 günde istismar olasılığı)

1.90%

tüm CVE'lerin %80'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: poc
Otomatikleştirilebilir: yes
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2023-12-28
Yayımlandı2024-02-27 11:30
IP-DB'ye ulaştı2026-10-24 23:53
Son güncelleme2024-08-09 22:09

Numarayı veren (CNA): WPScan

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

8.8Yüksek

CVE-2026-13764 5 saat önce

Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

StylemixThemes Masterstudy - Education WordPress Theme

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJ…

8.8Yüksek

CVE-2026-16135 5 saat önce

VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()

VibeThemes VibeBP

The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possibl…

8.8Yüksek

CVE-2026-15309 5 saat önce

CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint

WishList Member CourseCure Courses

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update…

5.4Orta

CVE-2026-2982 5 saat önce

WP Table Builder – Drag & Drop Table Builder <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'

wptb WP Table Builder – Drag & Drop Table Builder

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possib…

8.8Yüksek

CVE-2026-125836 9 saat önce

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Nicu Micle Simple JWT Login

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

5.3Orta

CVE-2026-124817 10 saat önce

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.