WordPress Plugin: backupbuddy: CVE-2022-31474: External Control of File Name or Path

The BackupBuddy plugin for WordPress is vulnerable to unauthenticated arbitrary file downloads via the 'local-download' found in the backupbuddy_local_download() function in versions 8.5.8.0 to 8.7.4.1. This is due to a missing capability check and nonce check on the affected function that is called via an admin_init hook along with insufficient file path validation on the supplied download file. This makes is possible for unauthenticated attackers to supply the complete path to a file, or use directory traversal techniques, to read any file hosted on the server. This includes sensitive files such as /etc/passwd and /wp-config.php.