CVE-2023-3132
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 4.4.1.1 due to insufficient controls on the storage of back-up files. This allows unauthenticated attackers to extract sensitive data, including the entire installations database, if a backup occurs and the deletion of the back-up files fails.
Risk Assessment
Organizations may be exposed to the loss of confidential data, which can lead to serious legal and reputational consequences. Attackers may gain access to critical information, increasing the risk of further attacks.
Recommendation
It is recommended to update the MainWP Child plugin to the latest version to mitigate this vulnerability. Additionally, appropriate access controls for backup files should be implemented.
Original NVD description (English source)
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.