module
Wordpress Plugin Backup Guard - Authenticated Remote Code Execution
| Disclosed |
|---|
| May 4, 2021 |
Disclosed
May 4, 2021
Description
This module allows an attacker with a privileged Wordpress account to launch a reverse shell
due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard
This is due to an incorrect check of the uploaded file extension which should be of SGBP type.
Then, the uploaded payload can be triggered by a call to `/wp-content/uploads/backup-guard/.php`
due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard
This is due to an incorrect check of the uploaded file extension which should be of SGBP type.
Then, the uploaded payload can be triggered by a call to `/wp-content/uploads/backup-guard/.php`
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.