CVE-2024-56070: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability has been identified in Azzaroco WP SuperBackup plugin versions through 2.3.3. The vulnerability was discovered by Dave Jong from Patchstack and was disclosed on December 18, 2024. This security issue allows exploiting incorrectly configured access control security levels in the WordPress plugin (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 7.4 (High). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, low privileges required, no user interaction needed, and low impacts on confidentiality, integrity, and availability (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. It allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks (Patchstack).

Users are advised to update to WP SuperBackup version 2.4 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).