WordPress BackWPup < 4.0.4 - Backup File Disclosure
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.
PoC 已收录backwpup
CVSS7.5EPSS 2.3%