CVE-2023-7232 - Vulnerability Details - OpenCVE

The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00314.

Key SSVC decision points have not yet been added.

Vendors	Products
Wpbackitup	Backup And Restore Wordpress

Configuration 1 [-]

cpe:2.3:a:wpbackitup:backup_and_restore_wordpress:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://wpscan.com/vulnerability/323fef8a-aa17-4698-9a02-c12d1d390763/

History

Wed, 07 May 2025 01:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wpbackitup Wpbackitup backup And Restore Wordpress
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:wpbackitup:backup_and_restore_wordpress::::::wordpress::*
Vendors & Products		Wpbackitup Wpbackitup backup And Restore Wordpress

Fri, 22 Nov 2024 12:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-03-26T05:00:02.063Z

Updated: 2024-08-02T17:32:05.721Z

Reserved: 2024-01-12T15:11:32.941Z

Link: CVE-2023-7232

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2024-03-26T05:15:48.660

Modified: 2025-05-07T01:29:49.817

Link: CVE-2023-7232

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-7232", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-01-12T15:11:32.941Z", "datePublished": "2024-03-26T05:00:02.063Z", "dateUpdated": "2024-08-02T17:32:05.721Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-03-26T05:00:02.063Z"}, "title": "Backup and Restore WordPress <= 1.45 - Unauthenticated Sensitive Data Exposure", "problemTypes": [{"descriptions": [{"description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Backup and Restore WordPress ", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "1.45"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data"}], "references": [{"url": "https://wpscan.com/vulnerability/323fef8a-aa17-4698-9a02-c12d1d390763/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Dmitrii Ignatyev", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:57:35.189Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/323fef8a-aa17-4698-9a02-c12d1d390763/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}, {"affected": [{"vendor": "wpbackitup", "product": "wp_backitup", "cpes": ["cpe:2.3:a:wpbackitup:wp_backitup:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.45", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T17:30:30.845935Z", "id": "CVE-2023-7232", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T17:32:05.721Z"}}]}}