CVE-2024-56067: WP SuperBackup Auth Bypass Vulnerability

CVE-2024-56067 Overview

CVE-2024-56067 is a missing authorization vulnerability in the azzaroco WP SuperBackup (indeed-wp-superbackup) WordPress plugin. The flaw affects all versions up through 2.3.3. An unauthenticated remote attacker can download backup files generated by the plugin because the download endpoint does not enforce access control checks. Backup archives typically contain database dumps, configuration files, and credentials, making confidentiality the primary impact. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can download full site backups containing database contents, secrets, and source code from vulnerable WordPress installations.

Affected Products

azzaroco WP SuperBackup (indeed-wp-superbackup) plugin for WordPress
All versions from initial release through 2.3.3
WordPress sites using the plugin to generate site backups

Discovery Timeline

2024-12-31 - CVE-2024-56067 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56067

Vulnerability Analysis

The WP SuperBackup plugin exposes a backup file download handler that does not verify the requester's privileges or session state. Any HTTP client can issue a request to the download endpoint and retrieve archived backup files stored by the plugin. Because backups produced by WordPress backup utilities normally include the full wp_* database tables, wp-config.php secrets, uploaded media, and plugin source, a single successful request can hand an attacker the contents of the entire site.

The network-reachable nature of the endpoint and the absence of authentication or capability checks make exploitation trivial. The EPSS score of 10.034% places this vulnerability in the 95th percentile of exploit likelihood, reflecting both ease of exploitation and attacker interest.

Root Cause

The root cause is a missing capability check on the backup download route. Secure WordPress plugin design requires calls to current_user_can() and check_admin_referer() (or a nonce verification) before serving privileged file content. The WP SuperBackup download handler omits these checks, treating the endpoint as publicly reachable.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker enumerates or guesses the backup file path or queries the plugin's download endpoint directly. The server returns the backup archive without prompting for authentication. Predictable backup filenames or directory indexing further reduce the effort required. See the Patchstack Vulnerability Report for additional technical context.

No verified proof-of-concept code is published in the referenced sources, and this article does not provide synthetic exploit code.

Detection Methods for CVE-2024-56067

Indicators of Compromise

Unauthenticated HTTP GET requests to WP SuperBackup endpoints returning application/zip, application/octet-stream, or large response bodies.
Access log entries referencing the plugin path /wp-content/plugins/indeed-wp-superbackup/ followed by file downloads.
Outbound transfers of multi-megabyte responses to IP addresses with no prior administrative session history.

Detection Strategies

Inspect web server access logs for requests targeting WP SuperBackup download handlers without preceding wp-login.php authentication events.
Alert on anonymous downloads of files with extensions such as .zip, .sql, or .tar.gz from wp-content directories.
Correlate plugin endpoint hits with HTTP 200 responses larger than a defined threshold to flag bulk data egress.

Monitoring Recommendations

Enable WordPress audit logging to record backup creation and download operations performed by the plugin.
Forward web server, WAF, and WordPress logs to a central SIEM for retention and correlation across sites.
Monitor for scanner user agents and request bursts targeting known WordPress backup plugin paths.

How to Mitigate CVE-2024-56067

Immediate Actions Required

Deactivate and remove the WP SuperBackup plugin if a patched version is not available for your installation.
Rotate all secrets contained in prior backups, including database passwords, wp-config.php salts, and API keys.
Move existing backup archives outside the webroot and restrict directory access at the web server level.
Audit web server logs for prior unauthenticated downloads of backup files since the plugin was installed.

Patch Information

The Patchstack advisory lists all versions through 2.3.3 as vulnerable, and no fixed version is identified in the NVD record at the time of publication. Site operators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org listing for an updated release and apply it immediately when available.

Workarounds

Block external access to /wp-content/plugins/indeed-wp-superbackup/ and any backup storage paths using web server rules or a WAF.
Relocate backup output to a directory outside the public webroot, such as a path above public_html.
Enforce HTTP authentication or IP allow-listing on backup endpoints until the plugin is patched or replaced.

bash

# Example Nginx rule to block direct access to the vulnerable plugin path
location ~* /wp-content/plugins/indeed-wp-superbackup/ {
    deny all;
    return 403;
}

# Example Apache .htaccess rule for the backup directory
<DirectoryMatch "wp-content/plugins/indeed-wp-superbackup">
    Require all denied
</DirectoryMatch>