CVEvulnerability

CVE-2024-10028

7.5 HIGH Published 2024-11-06 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2024-11-06
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-922

Description

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.13 via the exposed process stats file during the backup process. This makes it possible for unauthenticated attackers to obtain an archive file name and download the site's backup.

Affected configurations

• everestthemes everest backup (< 2.2.14)

Weakness · CWE (1)

CWE-922 Insecure Storage of Sensitive Information weakness

References

https://plugins.trac.wordpress.org/browser/everest-backup/tags/2.2.13/inc/classes/class-backup-directory.php#L514 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/9b871957-a2b3-492f-b461-7040d9098b2b?source=cve Third Party Advisory

CVE-2024-10028

Description

Affected configurations

Related

Weakness · CWE (1)

References