CVE-2021-24174 EXPLOIT
8.1
HIGH · CVSS 3.1 · EPSS 3.2% (pctl 88)
Patch early
A public exploit exists.
Description
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
Scoring
| CVSS | 8.1 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| EPSS | 3.22% — more likely to be exploited than 88% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2021-04-05 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| database-backups project | database-backups |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF | 2021-06-11 |
References
- http://packetstormsecurity.com/files/163091/WordPress-Database-Backups-1.2.2.6-Cross-Site-Request-Forgery.html
- https://wpscan.com/vulnerability/350c3e9a-bcc2-486a-90e6-d1dc13ce1bd5
- http://packetstormsecurity.com/files/163091/WordPress-Database-Backups-1.2.2.6-Cross-Site-Request-Forgery.html
- https://wpscan.com/vulnerability/350c3e9a-bcc2-486a-90e6-d1dc13ce1bd5
→ the Explorer · watch your stack · NVD