Critical vulnerability identified in WordPress plugin “BackupBuddy”: (CVE-2022-31474)

This vulnerability is currently being actively exploited with over five million attempts to exploit having been recorded so far.

The flaw exists within the WordPress plugin BackupBuddy (https://ithemes.com/backupbuddy/) and any WordPress instances with the plugin installed may be affected. This vulnerability allow an unauthenticated attacker to view the contents of any file on the affected server that can could be read by your WordPress installation. This may include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd.”

Affected Versions

• 8.5.8.0 to 8.7.4.1

Remediation

This issue has been remediated in version 8.7.5, all users of the BackupBuddy plugin are advised to upgrade to the latest version available.

References

• https://ithemes.com/blog/wordpress-vulnerability-report-special-edition-september-6-2022-backupbuddy/
• https://www.wordfence.com/blog/2022/09/psa-nearly-5-million-attacks-blocked-targeting-0-day-in-backupbuddy-plugin/

Part 2: CBEST Series – Operational Resilience

CBEST threat-led testing proves whether your organization can withstand real-world attacks, uncovering hidden weaknesses and driving true operational resilience.

Can AI Really Hack You? The Truth Behind the Hype

AI’s role in cybersecurity has evolved from boardroom buzzword to operational threat. As headlines oscillate between “AI revolution” and “AI apocalypse,” one question persists for security…

Remote Work Security Gaps Still Driving UK Breaches

Despite years of adaptation, organizations are still being breached through remote access blind spots.