Threats tagged 'ghsa-q8gp-6fc4-wgxp'

The BackUpWordPress plugin versions prior to 3.15 lack capability and nonce checks on an AJAX action responsible for cleaning up the backup directory. This flaw allows any authenticated user with Subscriber-level permissions or higher to delete backup protection and working files, potentially disrupting ongoing backups and removing download protection from stored backups.