CVE-2020-35948
Critical
Description
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.
SeverityCritical
CVSS9.9
Exploit probability—
ProductXcloner
PublishedJan 1, 2021
First seenJan 1, 2021
How to fix
Update
- xcloner xcloner4.2.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xcloner xcloner | 4.2.1 ≤ v < 4.2.13 | 4.2.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.