Blogvault Real Time Backup Vulnerabilities

The BlogVault WordPress Backup Plugin for WordPress is vulnerable to PHP Object Injection in versions 1.40 - 1.44 via deserialization of untrusted input in the vulnerable function processApiRequest. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP...

CVSS:

8.3

Affected:

1.40 – 1.44

Fixed in:

1.45

Disclosed:

Apr 6, 2017

The BlogVault WordPress Backup Plugin for WordPress is vulnerable to PHP Object Injection in versions 1.40 - 1.44 via deserialization of untrusted input in the vulnerable function processApiRequest. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP...

Affected:

1.40 – 1.44

Fixed in:

1.44

Disclosed:

Apr 6, 2017

This plugin is prone to a admin.php blogVault key setting cross site request forgery vulnerability. Update the plugin.

Affected:

up to 1.06

Fixed in:

1.06

Disclosed:

Aug 1, 2014

This plugin is prone to a missing account empty secret key generation vulnerability. Update the plugin to v1.0.9

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Aug 1, 2014

The Backup & Staging – BlogVault Backups WordPress plugin was affected by an Unauthenticated PHP Object Injection security vulnerability.

Affected:

1.40 – 1.44

Fixed in:

1.44

The Backup & Staging – BlogVault Backups WordPress plugin was affected by an admin.php blogVault Key Setting CSRF security vulnerability.

Affected:

up to 1.06

Fixed in:

1.06

Affected:

up to 1.09

Fixed in:

1.09