CVE-2023-5737

4.3 mediumEPSS 0.5%

Medium (4.3) in webtoffee backup and migration. EPSS 0.5% chance of exploitation in the next 30 days.

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2023-11-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

webtoffee:backup_and_migration

References

https://wpscan.com/vulnerability/c761c67c-eab8-4e1b-a332-c9a45e22bb13
https://wpscan.com/vulnerability/c761c67c-eab8-4e1b-a332-c9a45e22bb13

Check your stack JSON