CVE-2024-13807: Xagio SEO Information Disclosure Flaw

CVE-2024-13807 Overview

CVE-2024-13807 affects the Xagio SEO plugin for WordPress in all versions up to and including 7.1.0.5. The plugin's backup functionality generates archive files with a predictable naming structure and stores them in a directory without access controls. Unauthenticated attackers can enumerate and download backup archives that may contain the full WordPress database and site files. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact

Unauthenticated remote attackers can retrieve complete database dumps and site backups, exposing credentials, user data, and configuration secrets.

Affected Products

• Xagio SEO plugin for WordPress, versions up to and including 7.1.0.5
• WordPress sites with the Xagio SEO backup feature enabled
• Any site where the plugin's backup directory is web-accessible

Discovery Timeline

• 2025-08-28 - CVE-2024-13807 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-13807

Vulnerability Analysis

The Xagio SEO plugin includes a backup module that produces archive files containing the WordPress database export and site assets. The backup routine, implemented in modules/backups/models/xagio_backups.php, generates filenames using a weak structure that an attacker can guess or enumerate. The plugin also fails to place access controls on the directory holding these archives.

Because backups remain reachable over HTTP without authentication, an attacker who learns or brute-forces a filename can download the archive directly. Extracted backups can include the entire wp_users table with password hashes, wp_options containing secrets and API keys, and uploaded site files. This converts a misconfigured backup into a full site compromise vector.

Root Cause

Two defects combine to create the exposure. First, the backup filename generation lacks sufficient entropy and unpredictability. Second, the backup storage directory does not enforce authentication or use a non-indexable, randomized path. Together they violate the principle that sensitive artifacts must not be reachable by anonymous network actors. Reference the vulnerable code at WordPress Plugin Backup Code.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker issues HTTP GET requests against the plugin's backup directory, iterating through predictable filename patterns. When a request returns an archive, the attacker downloads it and extracts the contents offline. No exploit code is required beyond standard web tooling such as curl or directory enumeration utilities. Refer to the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2024-13807

Indicators of Compromise

• HTTP GET requests targeting the Xagio SEO backup directory from external IP addresses
• Successful 200 OK responses delivering .zip, .sql, or .tar.gz files from the plugin path
• Repeated 404 responses indicating filename enumeration against the backup directory
• Unexpected egress of large archive files originating from the WordPress host

Detection Strategies

• Search web server access logs for requests containing xagio-seo and archive file extensions
• Alert on anonymous downloads of files larger than a defined threshold from /wp-content/ paths
• Correlate sequential requests with incrementing or pattern-matching filenames against plugin directories

Monitoring Recommendations

• Enable WordPress access logging with full request URI capture and retain logs for forensic review
• Monitor outbound bandwidth from web servers for spikes consistent with backup exfiltration
• Run scheduled scans against your own site to verify backup files are not publicly retrievable

How to Mitigate CVE-2024-13807

Immediate Actions Required

• Update the Xagio SEO plugin to a version newer than 7.1.0.5 that includes the fix from WordPress Changeset #3292024
• Remove all existing backup archives from the plugin's storage directory and regenerate them after patching
• Rotate WordPress administrator passwords, database credentials, and any API keys stored in wp-config.php or the options table
• Audit web server logs for prior unauthorized access to backup files

Patch Information

The vendor addressed the issue in the changeset published at WordPress Changeset #3292024. Apply the latest plugin update through the WordPress admin dashboard or via WP-CLI using wp plugin update xagio-seo.

Workarounds

• Disable the Xagio SEO backup feature until the plugin is updated
• Block external access to the plugin's backup directory using web server access controls
• Move backup artifacts to a storage location outside the web root

# Restrict access to the Xagio SEO backup directory via .htaccess
<Directory "/var/www/html/wp-content/plugins/xagio-seo/">
    <FilesMatch "\.(zip|sql|tar|gz)$">
        Require all denied
    </FilesMatch>
</Directory>