CVE-2020-35948: 
WordPress vulnerability analysis and mitigation

An issue was discovered in the XCloner Backup and Restore plugin before version 4.2.13 for WordPress. The vulnerability (CVE-2020-35948) was publicly disclosed on December 31, 2020, affecting versions 4.2.1 through 4.2.12 of the plugin. This security flaw gave authenticated attackers with subscriber-level or above capabilities the ability to modify arbitrary files, including PHP files (NVD, Wordfence).

The vulnerability stems from an unprotected AJAX endpoint in the xcloner_restore.php file, specifically in the write_file_action function. The flaw allows authenticated attackers to modify arbitrary files, including critical system files like wp-config.php. The vulnerability has received a CVSS v3.1 base score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (Wordfence).

The vulnerability allows attackers to achieve remote code execution on a vulnerable site's server. Additionally, attackers could create an exploit chain to obtain database dumps due to the same unprotected AJAX endpoint. The ability to modify critical WordPress files like wp-config.php could lead to complete site compromise (WPScan).

Public exploits for this vulnerability are available. The vulnerability requires authentication with subscriber-level or higher privileges, making it exploitable by any authenticated user. Proof of concept code has been published that demonstrates the ability to retrieve site database credentials and full file paths (WPScan, Github).

The vulnerability has been patched in version 4.2.13 of the XCloner Backup and Restore plugin. Site administrators are strongly advised to update to this version or later to protect against this vulnerability (NVD).