漏洞描述
The Super Backup & Clone - Migrate for WordPress plugin (indeed-wp-superbackup) is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to and including 2.3.3. Unauthenticated attackers can upload arbitrary PHP files on the affected site's server which leads to remote code execution. Files are written to /wp-content/uploads/isnapshots/.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
patchstack.comhttps://patchstack.com/database/wordpress/plugin/indeed-wp-superbackup/vulnerability/wordpress-wp-superbackup-plugin-2-3-3-unauthenticated-arbitrary-file-upload-vulnerability↗github.comhttps://github.com/RandomRobbieBF/CVE-2024-56064↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2024-56064↗wpscan.comhttps://wpscan.com/vulnerability/ab939130-3a48-4179-8722-0f09340aee4d/↗