CVE-2023-5504 – The BackWPup WordPress plugin up to version 4.0... (How to Fix)

Q: What is the severity of CVE-2023-5504?

CVE-2023-5504 has a CVSS score of 8.7 (HIGH). The BackWPup WordPress plugin up to version 4.0.1 contains a directory traversal vulnerability in the Log File Folder setting. Authenticated attackers can store backups in arbitrary server directories, potentially disabling other websites in shared hosting environments by overwriting critical files. This affects WordPress sites using vulnerable BackWPup versions.

📋 TL;DR

The BackWPup WordPress plugin up to version 4.0.1 contains a directory traversal vulnerability in the Log File Folder setting. Authenticated attackers can store backups in arbitrary server directories, potentially disabling other websites in shared hosting environments by overwriting critical files. This affects WordPress sites using vulnerable BackWPup versions.

💻 Affected Systems

Products:

BackWPup WordPress Plugin

Versions: All versions up to and including 4.0.1

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user access to plugin settings. Shared hosting environments are particularly vulnerable due to directory structure.

📦 What is this software?

Backwpup by Inpsyde

View all CVEs affecting Backwpup →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attacker disables other websites on shared hosting by overwriting index.php and .htaccess files, potentially causing complete service disruption and data loss.

🟠

Likely Case

Unauthorized backup storage in sensitive directories, potential website disruption if attacker targets own site's critical directories.

🟢

If Mitigated

Limited to backup storage in permitted directories with no ability to execute code or access sensitive data.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access to WordPress admin or user with plugin configuration permissions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.0.2 and later

Vendor Advisory: https://wordpress.org/plugins/backwpup/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find BackWPup and click 'Update Now'. 4. Verify version is 4.0.2 or higher.

🔧 Temporary Workarounds

Disable BackWPup Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate backwpup

Restrict Plugin Access

all

Limit which users can access BackWPup settings

Use WordPress role management to restrict 'manage_options' capability

🧯 If You Can't Patch

Remove BackWPup plugin entirely and use alternative backup solutions
Implement strict file permission controls on web server directories

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → BackWPup → Version. If version is 4.0.1 or lower, system is vulnerable.

Check Version:

wp plugin get backwpup --field=version

Verify Fix Applied:

Confirm BackWPup version is 4.0.2 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unauthorized directory path modifications in BackWPup settings
Unexpected .htaccess or index.php file creation in non-standard locations

Network Indicators:

Unusual backup file transfers to unexpected directories

SIEM Query:

source="wordpress" AND (event="plugin_settings_change" AND plugin="backwpup" AND setting="log_folder")

📊 Metadata

CVE ID: CVE-2023-5504

CVSS v3 Score: 8.7 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

CWE: CWE-22

Published: January 11, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-5504, you might also want to check these: