CVE-2023-5576
Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure
highExposure of Sensitive Information to an Unauthorized Actor
8.0
CVSS Score
8.0
CVSS Score
high
Severity
0.9.92
Patched in
277d
Time to patch
Description
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:NAttack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
High
Confidentiality
High
Integrity
None
Availability
Technical Details
Affected versions
<=0.9.91PublishedOctober 13, 2023
Last updatedJuly 15, 2024
Affected pluginwpvivid-backuprestore
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.