CVE-2024-6559: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in watchful Backup, Restore and Migrate your sites with XCloner
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
AI Analysis
Technical Summary
The XCloner WordPress plugin up to version 4.7.3 suffers from a full path disclosure vulnerability (CWE-200) because it uses the sabre library without preventing direct file access. This allows unauthenticated remote attackers to obtain the full path of the web application. The vulnerability does not directly lead to data compromise or service disruption but may facilitate further attacks when combined with other vulnerabilities.
Potential Impact
The vulnerability exposes the full filesystem path of the web application to unauthenticated attackers. While this information disclosure is limited in impact by itself, it can aid attackers in crafting more effective attacks if other vulnerabilities exist on the affected site. There is no direct confidentiality, integrity, or availability impact from this vulnerability alone.
Mitigation Recommendations
No official patch or remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, site administrators should monitor official vendor channels for updates and consider restricting access to plugin files or disabling the plugin if feasible to reduce exposure.
CVE-2024-6559: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in watchful Backup, Restore and Migrate your sites with XCloner
Description
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The XCloner WordPress plugin up to version 4.7.3 suffers from a full path disclosure vulnerability (CWE-200) because it uses the sabre library without preventing direct file access. This allows unauthenticated remote attackers to obtain the full path of the web application. The vulnerability does not directly lead to data compromise or service disruption but may facilitate further attacks when combined with other vulnerabilities.
Potential Impact
The vulnerability exposes the full filesystem path of the web application to unauthenticated attackers. While this information disclosure is limited in impact by itself, it can aid attackers in crafting more effective attacks if other vulnerabilities exist on the affected site. There is no direct confidentiality, integrity, or availability impact from this vulnerability alone.
Mitigation Recommendations
No official patch or remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, site administrators should monitor official vendor channels for updates and consider restricting access to plugin files or disabling the plugin if feasible to reduce exposure.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-07-08T14:53:56.566Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6c06b7ef31ef0b55f1cc
Added to database: 2/25/2026, 9:39:18 PM
Last enriched: 4/9/2026, 8:20:18 PM
Last updated: 5/29/2026, 7:13:19 PM
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.