Experts warn of attacks exploiting zero-day vulnerability in WordPress BackupBuddy plugin.
On September 6, 2022, the Wordfence Threat Intelligence team was informed of a vulnerability being actively exploited by bad actors in the BackupBuddy WordPress plugin. The plugin allows users to back up an entire WordPress installation, including theme files, pages, posts, widgets, users, and media files.
An unauthenticated user can exploit the WordPress vulnerability (plugin) to download arbitrary files from the affected site. It has been estimated that the plugin has around 140,000 active installations. The attackers were attempting to retrieve sensitive files such as the /wp-config.php and /etc/passwd.
The WordPress plugin allows storing backup files in multiple locations (Destinations) including Google Drive, OneDrive, and AWS. The plugin also allows storing backups via the ‘Local Directory Copy’ option, but experts discovered that this feature isn’t secure and allows unauthenticated users to download any file stored on the server.