Skip to content

Critical vulnerability identified in WordPress plugin “BackupBuddy”: (CVE-2022-31474)

We would like to bring to your attention a newly discovered vulnerability within the WordPress plugin “BackupBuddy".

  • Resources
  • Glossary
  • Critical vulnerability identified in WordPress plugin “BackupBuddy”: (CVE-2022-31474)

This vulnerability is currently being actively exploited with over five million attempts to exploit having been recorded so far.

The flaw exists within the WordPress plugin BackupBuddy (https://ithemes.com/backupbuddy/) and any WordPress instances with the plugin installed may be affected. This vulnerability allow an unauthenticated attacker to view the contents of any file on the affected server that can could be read by your WordPress installation. This may include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd.”

Affected Versions

  • 8.5.8.0 to 8.7.4.1

Remediation

This issue has been remediated in version 8.7.5, all users of the BackupBuddy plugin are advised to upgrade to the latest version available.

References

Dark office with an empty chair by a window representing constant cyber attack and unseen threats

What Is Constant Cyber Attack?

CovertSwarm COO Luke Potter explains why traditional testing no longer reflects how real attackers operate. In this piece, he defines constant cyber attack, a discipline built…
OT worker in the dark

Threat Actors Don’t Wait For Your Annual OT Pen test

Annual OT pen tests provide snapshots. Real attackers operate continuously. This is why your operational technology security strategy needs to evolve.
Abstract image of people walking with long shadows on a city street, symbolising human presence guiding automation in offensive security.

Humans In The Loop: The Non-Negotiable In Offensive Security

AI and automation have transformed offensive security, but not replaced human ingenuity. Luke Potter explains why real attackers, and real defenders, still need humans in the…