CVE-2024-43297: Backupbliss Clone Auth Bypass Vulnerability

CVE-2024-43297 Overview

CVE-2024-43297 is a missing authorization vulnerability affecting the Backupbliss Clone plugin for WordPress, formerly known as WP Clone by WP Academy. The flaw exists in versions up to and including 2.4.5, allowing authenticated users with low privileges to abuse plugin functions that lack proper access control checks. The vulnerability is classified under [CWE-862] Missing Authorization and is exploitable over the network with low attack complexity.

Critical Impact
An authenticated attacker with minimal privileges can access clone and migration functions, compromising site confidentiality, integrity, and availability on affected WordPress installations.

Affected Products

Backupbliss Clone (WordPress plugin) versions from n/a through 2.4.5
WP Clone by WP Academy (prior product name)
WordPress installations running the vulnerable plugin

Discovery Timeline

2024-11-01 - CVE-2024-43297 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43297

Vulnerability Analysis

The Backupbliss Clone plugin exposes migration and cloning functions that fail to verify whether the requesting user holds sufficient privileges. The plugin relies on incorrectly configured access control security levels, treating low-privileged authenticated sessions as if they were administrative. As a result, subscribers, contributors, or other low-tier users can invoke sensitive backup, clone, and migration routines. Successful exploitation can lead to arbitrary file operations, database exposure, and full compromise of the WordPress site.

The vulnerability requires an authenticated session but no user interaction, which lowers the bar for exploitation on sites that allow open registration. Because clone plugins operate on entire site archives, abuse can cascade into data theft and persistent backdoors within restored archives.

Root Cause

The root cause is missing authorization checks on plugin action handlers. The code paths that trigger clone creation, restoration, and migration do not enforce a current_user_can() capability check or comparable role validation before executing privileged operations. See the Patchstack Vulnerability Advisory for technical details.

Attack Vector

An attacker first obtains a valid WordPress account at any privilege level, including subscriber. The attacker then sends crafted HTTP requests to the plugin's AJAX or admin-post endpoints that invoke clone or migration actions. Because the endpoints do not validate the caller's role, the plugin executes the operation under the attacker's session and returns results such as backup archives or restored content.

No verified public exploit code is available for this vulnerability.
Refer to the Patchstack advisory linked above for technical analysis.

Detection Methods for CVE-2024-43297

Indicators of Compromise

Unexpected requests to admin-ajax.php or admin-post.php with action parameters referencing clone, backup, or migrate operations from non-administrative user sessions.
Creation of new archive files (.zip, .tar, .sql) in the plugin's working directory outside of scheduled maintenance windows.
New or modified WordPress users, options, or plugins appearing shortly after clone or restore activity.

Detection Strategies

Enable WordPress audit logging to capture plugin action invocations and correlate them with the authenticated user role.
Review web server access logs for POST requests to Clone plugin endpoints originating from low-privileged accounts.
Compare filesystem state against known-good baselines to identify unauthorized archive generation or file restoration.

Monitoring Recommendations

Alert on HTTP requests to Clone plugin endpoints where the session cookie belongs to a subscriber or contributor role.
Monitor for outbound transfers of large archive files from the WordPress uploads or plugin directories.
Track changes to wp_users, wp_options, and plugin directories for indicators of restore-based persistence.

How to Mitigate CVE-2024-43297

Immediate Actions Required

Update the Backupbliss Clone plugin to a version later than 2.4.5 as soon as a patched release is available from the vendor.
Audit existing WordPress accounts and remove or disable any unused low-privileged accounts, particularly on sites permitting open registration.
Review recent clone, backup, and restore activity for signs of unauthorized use.

Patch Information

Refer to the Patchstack Vulnerability Advisory for vendor patch status. If no fixed version is available, deactivate and remove the plugin until the vendor releases a corrected build.

Workarounds

Deactivate the Clone plugin on production sites where migration functionality is not actively required.
Restrict access to wp-admin and admin-ajax.php at the web server or WAF layer to trusted IP ranges.
Disable open user registration and enforce strong role separation until a patched version is deployed.

bash

# Example: restrict admin-ajax.php Clone actions at the web server layer (nginx)
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "(wpclone|clone|migrate|backup)") {
        allow 203.0.113.0/24;   # trusted admin network
        deny all;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}