Threats tagged 'ghsa-r8c6-j9mg-4j2v'

Backup Migration plugin for WordPress versions before 2.1.8 contains a path traversal vulnerability in its PclZip restore fallback mechanism. This flaw allows an attacker to craft a malicious zip archive with directory traversal sequences that bypass extraction restrictions when the PHP zip extension is not present. If an administrator restores such a malicious backup, arbitrary files, including PHP scripts, can be written outside the intended directory, potentially enabling remote code execution.