CVE-2022-2863

WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read

The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack

Affected

Migration, Backup, Staging – WPvivid

CVSS v3.1 NVD

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

25.29% chance of exploitation in the next 30 days, 98th percentile

Nuclei

medium · CWE-22

Published

2022-09-16

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html
• https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2863.yaml

Security advisories

• http://seclists.org/fulldisclosure/2022/Oct/0

References

• CVE Record
• NVD entry