CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2024-13911: Database Backup and check Tables Automated With Scheduler 2024 <= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure

7.2 CVSS

Description

The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level access and above, to extract sensitive data including full database credentials.

Classification

CVE ID: CVE-2024-13911

CVSS Base Severity: HIGH

CVSS Base Score: 7.2

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem Types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Vendor: sminozzi

Product: Database Backup and check Tables Automated With Scheduler 2024

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.1% (probability of being exploited)

EPSS Percentile: 25.09% (scored less or equal to compared to others)

EPSS Date: 2025-03-30 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2024-13911
https://www.wordfence.com/threat-intel/vulnerabilities/id/c548b70a-8566-4aaf-a3a2-fce6c19e6a0c?source=cve
https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L62
https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L63
https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L64
https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L65
https://plugins.trac.wordpress.org/browser/database-backup/trunk/dashboard/backup.php#L66
https://plugins.trac.wordpress.org/changeset/3247917/

Timeline