CVE-2024-56064

CVE-2024-56064 is an unrestricted file upload flaw (CWE-434) in the WP SuperBackup WordPress plugin (slug: indeed-wp-superbackup) that fails to restrict uploaded files to safe types. Because the upload path requires no privileges or user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), a remote attacker can send a crafted upload request directly and plant a malicious file, typically a PHP web shell, on the web server. Once the shell is uploaded and executed, the attacker gains code execution on the site, with confidentiality, integrity, and availability all rated high and the scope changed, meaning the compromise can extend beyond the vulnerable component. Any WordPress site running WP SuperBackup in any version up to and including 2.3.3 is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, but the EPSS score of 30.8% (98th percentile) indicates an elevated probability of exploitation within the next 30 days.

What to do: Update WP SuperBackup to the latest patched release on WordPress.org, i.e., any version beyond 2.3.3, and remove or replace the plugin if it is no longer maintained. Until updated, deactivate the plugin, audit the uploads directory for unexpected .php files (indicating an already-planted web shell), and review web server logs for unauthenticated upload requests. As defense in depth, disable PHP execution in wp-content/uploads so uploaded shells cannot run.