CVE-2023-6271: 
WordPress vulnerability analysis and mitigation

The Backup Migration WordPress plugin before version 1.3.6 contains a sensitive data exposure vulnerability (CVE-2023-6271) discovered by Dmitrii Ignatyev. The vulnerability allows attackers to access publicly-accessible files containing in-progress backup information, which may lead to the exposure of sensitive site data (WPScan, CleanTalk Research).

The vulnerability exists in the wordpress/wp-content/plugins/backup-backup/includes/htaccess/db_tables directory where backup files are stored during the backup process. These files are publicly accessible and contain sensitive database information including configuration details, user data, and system files. The vulnerability has been assigned a CVSS score of 8.2 (High) and is classified under CWE-200 (Information Exposure) and OWASP Top 10 category A3: Sensitive Data Exposure (WPScan).

Successful exploitation of this vulnerability could allow attackers to access sensitive information from the site's backups, including database contents, configuration files, and user data. This exposure could potentially lead to unauthorized access, data theft, and complete system compromise through subsequent attacks like password hash cracking (CleanTalk Research).

The vulnerability is easily exploitable by monitoring the backup process and accessing publicly available files in the plugin's directory. During backup operations, sensitive files including database dumps (wp_users.sql, wp_links.sql, wp_termmeta.sql) and backup logs become accessible to unauthorized users (WPScan).

The vulnerability has been fixed in version 1.3.6 of the Backup Migration plugin. Site administrators are strongly advised to update to this version or later to prevent unauthorized access to sensitive backup data (WPScan).