CVE-2023-7164

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Unknown	BackWPup	< 4.0.4
inpsyde	backwpup	< 4.0.4

References

https://wpscan.com/vulnerability/79b07f37-2c6b-4846-bb28-91a1e5bf112e/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/79b07f37-2c6b-4846-bb28-91a1e5bf112e/Exploit, Third Party Advisory

Timeline

Published: Apr 8, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-71657.5The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certai CVE-2023-71665.4A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUse CVE-2023-71676.1The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users suc CVE-2023-71684.8The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high CVE-2023-71695.5Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects S CVE-2023-71706.1The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading t CVE-2023-71714.8A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown funct CVE-2023-71727.2A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is so CVE-2023-71735.4A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part o CVE-2023-71747.1The aBitGone CommentSafe WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as esca CVE-2023-71759.8A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unkn CVE-2023-71768.8A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the fi