CVE-2024-43268: 
WordPress vulnerability analysis and mitigation

Access Control vulnerability affects WPBackItUp Backup and Restore WordPress plugin through version 1.50. The vulnerability was discovered and reported by Ananda Dhakal to Patchstack, and was assigned CVE-2024-43268. The issue was published on August 12, 2024 (Patchstack Report).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability stems from missing authorization checks in the plugin's functionality (Patchstack Report).

The broken access control vulnerability could allow an unprivileged user to execute certain higher privileged actions. The issue has been assessed with low confidentiality impact and low integrity impact, with no impact on availability (Patchstack Report).

The vulnerability requires a low attack complexity and can be exploited by an authenticated user with subscriber-level privileges. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack Report).

Currently, there is no official fix available for this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available (Patchstack Report).