CVE-2024-3034

—

CVSS 3.1

2.7 low

EPSS

<1%p49

Published

Apr 27, 2024 (Apr 27, 2024)

Modified

Jun 17, 2026

Description

The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to traverse directories outside of the context in which the plugin should allow.

Ecosystems: WordPress
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.