CVE-2023-52183

The WordPress Backup & Migration plugin (versions up to and including 1.4.3) suffers from a missing authorization vulnerability, also described as broken access control. This flaw occurs because certain functions lack proper authentication or nonce token checks, enabling unprivileged users to execute actions that should be reserved for higher-privileged roles [1].

Exploitation does not require any prior authentication, making the attack surface broad and accessible to any unauthenticated attacker. Indeed, such vulnerabilities are commonly leveraged in mass-exploit campaigns targeting thousands of websites simultaneously, regardless of their size or popularity [1].

An attacker who successfully exploits the flaw can perform unauthorized operations, such as accessing or manipulating backup data. This could lead to data exposure, website defacement, or complete takeover. The vulnerability carries a CVSS v3 score of 5.4 (Medium) and is considered a low-severity issue, though it is still actively exploited.

The vendor released version 1.4.4 which addresses the vulnerability. Users are strongly advised to update to this version or enable auto-updates for vulnerable plugins. Those unable to update immediately should consult their hosting provider for interim measures [1].