CVE-2024-8669

The vulnerability results from insufficient escaping of the 'options' parameter passed to the backuply_wp_clone_sql() function and the lack of proper preparation of the existing SQL query. An attacker can append additional SQL queries to existing queries, allowing unauthorized data extraction from the database. Exploitation requires an account with administrator privileges or higher.

An attacker with administrator privileges can extract sensitive information stored in the WordPress database, including user data, passwords (in hash form), and other confidential application content.

The Backuply plugin should be updated to a version higher than 1.3.4, which includes a fix (changeset 3151205 in the plugin repository). The update can be performed from the WordPress administration panel or by manually downloading the current version from the plugins.trac.wordpress.org repository.

Backuply – Backup, Restore, Migrate and Clone plugin for WordPress in all versions up to and including 1.3.4 (product: Softaculous Backuply).