Executive Summary

The BackWPup plugin for WordPress has a Local File Inclusion vulnerability in the `block_name` parameter of its `/wp-json/backwpup/v1/getblock` REST endpoint. This vulnerability exists in all versions up to and including 5.6.6 because the sanitization of path traversal sequences uses a non-recursive `str_replace()`, which is insufficient. As a result, authenticated users with Administrator-level access or higher can exploit this flaw by crafting traversal sequences (like `....//`) to include arbitrary PHP files on the server.

This can allow attackers to read sensitive files such as `wp-config.php` or, in some configurations, execute remote code. Additionally, since administrators can grant backup handling permissions to other users, lower-level users might also exploit this vulnerability if given such permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to sensitive files and potential remote code execution on the affected server.

• Attackers with administrator or elevated permissions can read sensitive configuration files like `wp-config.php`.
• In certain server configurations, attackers may execute arbitrary PHP code remotely, leading to full system compromise.
• If administrators grant backup permissions to lower-level users, those users might also exploit this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated attackers with Administrator-level access to include arbitrary PHP files on the server, potentially leading to the reading of sensitive files such as wp-config.php or remote code execution.

Such unauthorized access to sensitive data and potential system compromise can negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive information and system integrity.

Useful 0 Not Useful 0