Package functions are accessible to every registered users because admin privileges are not checked properly.
So every registered user can create and download backup files.
Proof of Concept:
Login as regular user (created
using wp-login.php?action=register) then start scan:
After that you can build backup:
This function will return json with backup name inside
You can download backup using:
- 21-11-2014: Discovered
- 21-11-2014: Vendor notified
- 26-12-2014: Version 0.5.10 released, issue resolved