{"id":"CVE-2023-5737","aliases":["EUVD-2023-58023","GHSA-px94-47v9-w45x"],"status":"published","title":"WordPress Backup \u0026 Migration \u003c 1.4.4 - Subscriber+ Plugin Settings Update","description":"The WordPress Backup \u0026 Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0054,"percentile":0.45736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2023-11-27T16:22:02Z","modified":"2026-06-17T06:49:15Z","products":[{"vendor":"unknown","product":"wordpress backup \u0026 migration"},{"vendor":"webtoffee","product":"backup_and_migration"},{"vendor":"webtoffee","product":"wordpress backup \u0026 migration"}],"references":[{"url":"https://wpscan.com/vulnerability/c761c67c-eab8-4e1b-a332-c9a45e22bb13","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5737"},{"url":"https://github.com/advisories/GHSA-px94-47v9-w45x"}],"sources":{"cve":[{"id":"CVE-2023-5737","title":"WordPress Backup \u0026 Migration \u003c 1.4.4 - Subscriber+ Plugin Settings Update","description":"The WordPress Backup \u0026 Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.","status":"published","published":"2023-11-27T16:22:02.521Z","modified":"2024-08-02T08:07:32.645Z","updated_at":"2026-11-02T14:35:16.771348Z"}],"euvd":[{"id":"EUVD-2023-58023","description":"The WordPress Backup \u0026 Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.","status":"published","published":"2023-11-27T16:22:02Z","modified":"2024-08-02T08:07:32Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"none"}],"updated_at":"2026-11-03T03:50:11.066935Z"}],"ghsa":[{"id":"GHSA-px94-47v9-w45x","title":"The WordPress Backup \u0026 Migration WordPress plugin before 1.4.4 does not authorize some AJAX...","description":"The WordPress Backup \u0026 Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.","status":"published","published":"2023-11-27T18:31:14Z","modified":"2023-12-10T05:05:13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:55:10.314842Z"}],"nvd":[{"id":"CVE-2023-5737","description":"The WordPress Backup \u0026 Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.","status":"published","published":"2023-11-27T17:15:09.273Z","modified":"2026-06-17T06:49:15.937Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:08:49.393375Z"}]}}