CVE-2023-6750: Clone WordPress Information Disclosure

CVE-2023-6750 Overview

The Clone WordPress plugin before version 2.4.3 contains an information disclosure vulnerability where buffer files used to store in-progress backup information are stored at a publicly accessible, statically defined file path. This allows unauthenticated attackers to access sensitive backup data by directly requesting the predictable file location.

Critical Impact

Unauthenticated attackers can access sensitive backup information including database credentials, configuration data, and potentially complete site backups stored in publicly accessible file paths.

Affected Products

• Backupbliss Clone plugin for WordPress (versions before 2.4.3)

Discovery Timeline

• 2024-01-08 - CVE CVE-2023-6750 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-6750

Vulnerability Analysis

This vulnerability represents an information disclosure flaw stemming from insecure file storage practices in the Clone WordPress plugin. The plugin fails to implement proper access controls or randomized file paths for temporary backup buffer files, creating a predictable attack surface that can be exploited without authentication.

The core issue lies in how the plugin manages intermediate backup data. During the backup process, the plugin writes progress information and backup data to buffer files stored in a static, predictable directory path within the WordPress installation. Since these files are stored in web-accessible locations without proper .htaccess restrictions or authentication requirements, any remote attacker can directly request these files through the web server.

Root Cause

The vulnerability stems from insufficient security design in the plugin's backup handling mechanism. The developers implemented a static file path for buffer storage rather than using randomized, unpredictable file names and secure storage locations outside the web root. Additionally, the plugin lacks proper access controls to prevent unauthorized access to these temporary files during and after backup operations.

Attack Vector

An attacker can exploit this vulnerability by performing reconnaissance to identify WordPress sites using the vulnerable Clone plugin. Once identified, the attacker can directly request the known static file path where backup buffer files are stored. Since no authentication is required and the file path is predictable, the attacker can retrieve sensitive backup information including:

• Database connection strings and credentials
• WordPress configuration details
• User data and authentication tokens
• Complete or partial site backup archives

The attack can be automated at scale to target multiple WordPress installations simultaneously, making this vulnerability particularly dangerous for widespread exploitation.

Detection Methods for CVE-2023-6750

Indicators of Compromise

• Unusual HTTP requests targeting plugin backup directories such as /wp-content/plugins/clone/ or similar predictable paths
• Access logs showing repeated GET requests to static buffer file locations from unknown IP addresses
• Evidence of data exfiltration through large file downloads from backup-related paths
• Suspicious enumeration activity targeting WordPress plugin directories

Detection Strategies

• Monitor web server access logs for requests to known Clone plugin backup file paths
• Implement Web Application Firewall (WAF) rules to detect and block access attempts to plugin buffer directories
• Deploy file integrity monitoring on WordPress plugin directories to detect unauthorized access patterns
• Configure alerting for bulk data downloads from plugin directories

Monitoring Recommendations

• Enable verbose logging for the WordPress /wp-content/plugins/ directory
• Set up automated scanning to identify installations of the vulnerable Clone plugin version
• Implement network monitoring for unusual outbound data transfers that may indicate backup data exfiltration
• Regularly audit WordPress plugin versions across all managed installations

How to Mitigate CVE-2023-6750

Immediate Actions Required

• Upgrade the Clone WordPress plugin to version 2.4.3 or later immediately
• Audit web server access logs for evidence of exploitation attempts targeting backup file paths
• Remove any publicly accessible backup buffer files that may have been created by vulnerable versions
• Implement additional access controls on plugin directories through .htaccess or web server configuration

Patch Information

Update the Backupbliss Clone plugin to version 2.4.3 or later through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository. The patched version addresses the insecure file storage by implementing proper access controls and randomized file paths for backup buffer storage.

For additional technical details about this vulnerability, refer to the WPScan Vulnerability Report.

Workarounds

• If immediate patching is not possible, disable the Clone plugin until the update can be applied
• Add .htaccess rules to deny direct access to backup buffer directories
• Move backup storage locations outside the web-accessible root directory
• Implement server-level access controls to restrict access to plugin directories

# Apache .htaccess configuration to restrict access to backup directories
# Add to wp-content/plugins/clone/ directory
<Files "*">
    Order deny,allow
    Deny from all
</Files>

# Alternative: Restrict to admin-only access
<Files "*">
    Require ip 127.0.0.1
</Files>