Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

XCloner plugin may expose backup files to anyone

CVE-2014-8605 · published 11 years ago
Summary

The XCloner plugin for WordPress (version 3.1.1) and Joomla (version 3.5.1) saves database backup files in a predictable location that can be accessed through a web browser. Because the files are not properly protected, an attacker could download them and see sensitive data. Update the plugin to a patched version or move the backups to a location that is not publicly reachable and restrict access with proper permissions.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
xcloner xcloner 3.1.1
3.5.1
cpe:2.3:a:xcloner:xcloner:3.1.1:*:*:*:*:wordpress:*:*
Original advisory text
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers t...
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
7% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published10 Jun 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-8605 · NVD
Track software like this
Free during beta