What’s Vulnerable › Vulnerabilities

CVE-2023-5775: BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password

• Severity: low (CVSS 2.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-26 · updated 2026-06-17
• Weakness: CWE-256

Description

The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with administrator-level access, to retrieve the password from the password input field in the UI or from the options table where the password is stored.

Affected products

• wp_media BackWPup – WordPress Backup & Restore Plugin: before 4.0.3 — fixed in 4.0.3

How to fix

Upgrade to a fixed version: wp_media BackWPup – WordPress Backup & Restore Plugin 4.0.3. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3039678/backwpup
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4bce4f04-e622-468a-ac7e-5903ad50cc13?source=cve
• https://plugins.trac.wordpress.org/changeset/3039678/backwpup
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4bce4f04-e622-468a-ac7e-5903ad50cc13?source=cve

Get alerted when CVE-2023-5775 or the next vulnerability affects your stack