CVE-2024-56067: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Azzaroco WP SuperBackup plugin versions through 2.3.3. The vulnerability was identified on December 18, 2024, and allows for exploiting incorrectly configured access control security levels (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) and has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and primarily impacts confidentiality (Patchstack).

The vulnerability allows malicious actors to perform unauthorized backup file downloads. This could potentially expose sensitive information, including files containing login credentials or backup files from the affected website (Patchstack).

The vulnerability has been fixed in version 2.4 of the WP SuperBackup plugin. Users are advised to update to version 2.4 or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).