CVE-2024-12208: Backup and Restore Wordpress <= 1.50 - Cross-Site Request Forgery to Backup Trigger
Description
The Backup and Restore WordPress – Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.50. This is due to missing or incorrect nonce validation on the ajax_queue_manual_backup() function. This makes it possible for unauthenticated attackers to trigger backups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Classification
CVE ID: CVE-2024-12208
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
Affected Products
Vendor: cssimmon
Product: Backup and Restore WordPress – Backup Plugin
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.49% (scored less or equal to compared to others)
EPSS Date: 2025-02-05 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/e461a04b-6456-4930-b3e7-0f808825aa6b?source=cvehttps://wordpress.org/plugins/wp-backitup/