CVE-2022-1577

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2022-06-06

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346

References

• CVE Record
• NVD entry

Related

• CVE-2022-1576
• CVE-2022-1578
• CVE-2022-1575
• CVE-2022-1579
• CVE-2022-1574
• CVE-2022-1580