Critical vulnerability identified in WordPress plugin “BackupBuddy”: (CVE-2022-31474)

This vulnerability is currently being actively exploited with over five million attempts to exploit having been recorded so far.

The flaw exists within the WordPress plugin BackupBuddy (https://ithemes.com/backupbuddy/) and any WordPress instances with the plugin installed may be affected. This vulnerability allow an unauthenticated attacker to view the contents of any file on the affected server that can could be read by your WordPress installation. This may include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd.”

Affected Versions

• 8.5.8.0 to 8.7.4.1

Remediation

This issue has been remediated in version 8.7.5, all users of the BackupBuddy plugin are advised to upgrade to the latest version available.

References

• https://ithemes.com/blog/wordpress-vulnerability-report-special-edition-september-6-2022-backupbuddy/
• https://www.wordfence.com/blog/2022/09/psa-nearly-5-million-attacks-blocked-targeting-0-day-in-backupbuddy-plugin/

TechRound names CovertSwarm among the Top 20 Cybersecurity companies

The leading tech publisher recently released its inaugural Cybersecurity40 winners, celebrating the most innovative cybersecurity companies and initiatives across the UK and Europe.

The trials and tribulations of secure software development

Discover effective strategies for managing third-party libraries, tackling security challenges & handling technical debt in secure software development.

CovertSwarm launches in-house Academy Program

Socially-focused initiative has been designed to make a career in cybersecurity more accessible than ever before