CVE-2024-13910

Vulnerability

The vulnerability resides in the database_backup_ajax_delete function of the Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress. The function fails to properly validate the file path provided in AJAX requests, allowing an attacker to specify arbitrary paths. This affects all versions up to and including 2.35. The plugin defines its version constant in database-backup.php [1].

Exploitation

An attacker must have Administrator-level access (or higher) to the WordPress site. They can send a crafted AJAX request to the vulnerable function, supplying a malicious file path (e.g., using path traversal sequences) to delete any file on the server. No additional user interaction is required.

Impact

Successful exploitation enables the attacker to delete arbitrary files, including critical configuration files such as wp-config.php. This can lead to remote code execution or complete site compromise, as the attacker can disrupt the site or gain further access.

Mitigation

Version 2.36 of the plugin provides a partial patch for this vulnerability. Users are strongly advised to update to the latest available version. No workaround has been disclosed. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.