Clone < 2.4.3 - Unauthenticated Backup Download

Description The plugin uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.

PoC

While a backup job is running, visitors can access one of the following files (it might take a couple tries, as the timing needs to be right): “http://127.0.0.1/wordpress/wp-content/uploads/wp-clone/wpclone_backup/file.list”, “http://127.0.0.1/wordpress/wp-content/uploads/wp-clone/wpclone_backup/database.sql”, “http://127.0.0.1/wordpress/wp-content/uploads/wp-clone/wpclone_backup/prefix.txt”