CVE-2024-56070: WP SuperBackup Auth Bypass Vulnerability

CVE-2024-56070 Overview

CVE-2024-56070 is a missing authorization vulnerability in the WP SuperBackup plugin (indeed-wp-superbackup) for WordPress, developed by azzaroco. The flaw affects all versions up to and including 2.3.3. Authenticated users with low-privilege roles such as subscriber can access functionality that should be restricted to administrators. The weakness is classified under CWE-862 (Missing Authorization) and stems from incorrectly configured access control checks on plugin endpoints.

Critical Impact
Authenticated subscriber-level users can invoke backup-related plugin actions, potentially leading to disclosure, modification, or disruption of site backup data on affected WordPress installations.

Affected Products

WP SuperBackup (indeed-wp-superbackup) WordPress plugin
All versions from n/a through 2.3.3
WordPress sites with authenticated subscriber accounts enabled

Discovery Timeline

2024-12-31 - CVE-2024-56070 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56070

Vulnerability Analysis

The WP SuperBackup plugin exposes multiple actions that fail to verify the caller's capability level before executing sensitive operations. The Patchstack advisory describes this as multiple broken access control issues affecting subscriber-level users. Any user who can authenticate to WordPress with the lowest default role can trigger plugin functionality intended for site administrators.

Because the plugin manages site backups, unauthorized invocation of these endpoints can influence backup creation, retrieval, or configuration. The scope changes to Changed in the vector string, indicating the compromised component can affect resources beyond its security scope.

Root Cause

The root cause is missing current_user_can() capability checks (and likely missing nonce validation) on AJAX or admin-post handlers registered by the plugin. Handlers are hooked with wp_ajax_* actions that are reachable by any authenticated user, but the callbacks do not enforce that the user holds administrative capabilities such as manage_options or activate_plugins.

Attack Vector

Exploitation requires an authenticated session on the target WordPress site with at least subscriber privileges. Subscriber accounts are commonly created through open user registration on blogs, membership sites, and e-commerce stores. The attacker sends crafted HTTP POST requests to the plugin's admin-ajax endpoints while carrying valid session cookies. See the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2024-56070

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with plugin-specific action parameters originating from low-privilege user sessions
New or modified backup archives in the plugin's storage directory that do not correspond to scheduled administrator activity
Subscriber accounts issuing requests to backup, restore, or configuration endpoints of indeed-wp-superbackup

Detection Strategies

Review WordPress access logs for admin-ajax.php requests referencing WP SuperBackup actions initiated by non-administrator user IDs
Enable WordPress audit logging plugins to record capability checks and plugin action invocations for the affected plugin
Correlate authentication events for subscriber accounts with subsequent requests to plugin management endpoints

Monitoring Recommendations

Alert on any invocation of WP SuperBackup handlers by users whose role is not administrator
Monitor for enumeration of wp_ajax_* actions exposed by installed plugins
Track creation of new subscriber accounts followed by rapid activity against plugin endpoints

How to Mitigate CVE-2024-56070

Immediate Actions Required

Deactivate the WP SuperBackup plugin until a patched version above 2.3.3 is confirmed available and installed
Disable open user registration (Settings → General → Membership) if not required for site operation
Audit existing subscriber-level accounts and remove any that are unrecognized or inactive
Rotate WordPress secret keys in wp-config.php and force password resets for all users

Patch Information

At the time of NVD publication, no fixed version above 2.3.3 was listed in the referenced advisory. Site owners should consult the Patchstack Vulnerability Report and the plugin vendor for updated release information before re-enabling the plugin.

Workarounds

Restrict access to /wp-admin/admin-ajax.php via a web application firewall (WAF) rule that blocks WP SuperBackup action parameters from non-administrator sessions
Remove the plugin directory wp-content/plugins/indeed-wp-superbackup/ if backups are not currently required
Enforce two-factor authentication on all accounts to raise the cost of authenticated exploitation

bash

# Remove the vulnerable plugin from the WordPress installation
wp plugin deactivate indeed-wp-superbackup
wp plugin delete indeed-wp-superbackup

# Disable open registration via WP-CLI
wp option update users_can_register 0