CVE-2024-56273
Published: 07 January 2025
Description
Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPvivid Backup and Migration: from n/a through <= 0.9.106.
Security Summary
CVE-2024-56273 is a missing authorization vulnerability, classified under CWE-862, in the WPvivid Backup and Migration WordPress plugin (wpvivid-backuprestore). The issue allows accessing functionality not properly constrained by access control lists (ACLs). It affects all versions of the plugin from its initial release through 0.9.106.
The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Exploitation requires low privileges (PR:L) and can be performed over the network with low attack complexity and no user interaction. A successful attack results in low-impact integrity violations, enabling unauthorized access to restricted plugin functionality.
The Patchstack advisory provides further details on this broken access control vulnerability in WPvivid Backup and Migration version 0.9.106: https://patchstack.com/database/Wordpress/Plugin/wpvivid-backuprestore/vulnerability/wordpress-wpvivid-backup-plugin-0-9-106-broken-access-control-vulnerability?_s_id=cve.
Details
- CWE(s)