CVE-2013-2741 - CVE House
Back to Database
Status published High CVE-2013-2741

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and...

Vulnerability Description

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-2741

Credits & Attribution

No credits recorded in the NVD database.

References

More from ithemes

View All →
CVE-2020-36176
The iThemes Security (formerly Better WP Security) plugin before 7.7.0...
High 7.5
CVE-2020-14092
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65...
Critical 9.8
CVE-2018-7433
The iThemes Security plugin before 6.9.1 for WordPress does not...
High 7.5
CVE-2018-12636
The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows...
High 7.2
CVE-2015-9379
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS...
Medium 6.1

Affected Vendor

Affected Software

backupbuddy
Vulnerable Versions:
1.3.4, 2.1.4, 2.2.4, 2.2.25, 2.2.28

Timeline

Official Publish: April 2nd, 2013
Last Modified: September 17th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.