Wp Migration Duplicator Vulnerabilities

The WebToffee WP Backup and Migration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to extract sensitive information from export logs.

CVSS:

5.3

Affected:

up to 1.5.3

Fixed in:

1.5.4

Disclosed:

Jan 13, 2025

CVE-2025-24651 on NVD →

The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this fun...

CVSS:

4.3

Affected:

up to 1.4.8

Fixed in:

1.4.9

Disclosed:

Apr 22, 2024

CVE-2024-3546 on NVD →

The WordPress Backup & Migration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.7 via log files. This makes it possible for unauthenticated attackers to extract sensitive data from log files.

CVSS:

5.3

Affected:

up to 1.4.7

Fixed in:

1.4.8

Disclosed:

Apr 5, 2024

CVE-2024-31254 on NVD →

The WordPress Backup & Migration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above,...

CVSS:

6.4

Affected:

up to 1.4.4

Fixed in:

1.4.5

Disclosed:

Nov 6, 2023

CVE-2023-5738 on NVD →

The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_save_import_settings function in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to p...

CVSS:

4.3

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Nov 6, 2023

CVE-2023-5737 on NVD →

The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_save_settings and save_schedule functions in versions up to, and including, 1.4.1. This makes it possible for authenticated attackers, with subscriber-level access and abo...

CVSS:

5.4

Affected:

up to 1.4.1

Fixed in:

1.4.2

Disclosed:

Oct 11, 2023

CVE-2023-45636 on NVD →

The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wt_delete_schedule' AJAX function in versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the...

CVSS:

4.3

Affected:

up to 1.4.0

Fixed in:

1.4.1

Disclosed:

May 24, 2023

CVE-2023-33928 on NVD →