CVE-2023-5775

Executive Summary

CVE-2023-5775 is a low-severity vulnerability in the BackWPup WordPress plugin (versions up to and including 4.0.2) that exposes backup destination passwords in plaintext. This flaw allows authenticated attackers with administrator-level access to retrieve stored credentials directly from the WordPress admin UI or the wp_options database table. While the CVSS score is low (2.2) due to the high privileges required, the exposure of plaintext credentials can lead to lateral movement or compromise of external backup services (e.g., S3, Dropbox, FTP). The vulnerability is rooted in improper storage handling within the plugin’s settings, violating the principle of least privilege and secure credential management.

WordPress Ecosystem Context

This vulnerability is specific to the BackWPup plugin for WordPress. It does not affect the core WordPress application or web server software like Apache or Nginx. The issue lies entirely within the plugin’s codebase, which stores backup destination passwords in plaintext in the wp_options table and displays them in cleartext in the admin interface.

CVSS Breakdown & Threat Level

• CVSS Score: 2.2 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (password exposure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. Exploitation requires administrator-level access, limiting the attack surface. However, once an attacker gains admin credentials (e.g., via phishing or other vulnerabilities), they can extract plaintext passwords for external backup services, potentially enabling lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the BackWPup plugin’s settings handling. When an administrator configures a backup destination (e.g., Amazon S3, Dropbox, FTP), the plugin stores the password in the wp_options table under the option name backwpup_cfg. The password is stored in plaintext without encryption or hashing. Additionally, the plugin’s admin interface displays the password in cleartext in the input field when editing the destination settings.

Root Cause: The plugin uses get_option() and update_option() to store and retrieve the configuration array, which includes the password field. No encryption or masking is applied during storage or display.

Attack Scenario:

1. An attacker gains administrator-level access to the WordPress admin panel (e.g., via stolen credentials, session hijacking, or another vulnerability).
2. The attacker navigates to the BackWPup settings page (/wp-admin/admin.php?page=backwpup-settings).
3. The attacker views the backup destination configuration, where the password is displayed in plaintext in the input field.
4. Alternatively, the attacker queries the wp_options table directly (e.g., via SQL injection or database access) to retrieve the plaintext password.

Impact: Exposure of credentials for external services (e.g., cloud storage, FTP servers) can lead to data exfiltration, unauthorized access, or further compromise of connected systems.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 4.0.2): In the file inc/class-option.php or similar, the plugin stores the configuration array directly:

// Vulnerable: stores password in plaintext
$settings = get_option('backwpup_cfg');
$settings['destinations']['S3']['password'] = $_POST['s3_password'];
update_option('backwpup_cfg', $settings);

Patched Code (version 4.0.3+): The patched version encrypts the password before storage using WordPress’s wp_salt() or a similar encryption mechanism:

// Patched: encrypts password before storage
$settings = get_option('backwpup_cfg');
$settings['destinations']['S3']['password'] = base64_encode(openssl_encrypt($_POST['s3_password'], 'aes-256-cbc', wp_salt(), 0, substr(wp_salt('auth'), 0, 16)));
update_option('backwpup_cfg', $settings);

Additionally, the admin interface now masks the password field (e.g., using type="password" and not pre-filling the value).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Administrator-level access to a WordPress site with BackWPup plugin version <= 4.0.2.
• Access to the WordPress admin dashboard.

Steps:

1. Log in as an administrator.
2. Navigate to Settings > BackWPup or BackWPup > Settings.
3. Click on a backup destination (e.g., S3, Dropbox).
4. Observe the password field: the password is displayed in plaintext.
5. Alternatively, use a database query to extract the password:

   SELECT option_value FROM wp_options WHERE option_name = 'backwpup_cfg';
   

   The password will be in plaintext within the serialized array.

Proof of Concept (Python script to extract from database):

import requests
import re

# Assuming admin session cookie
cookies = {'wordpress_logged_in': 'admin_session_cookie'}
url = 'http://target.com/wp-admin/admin.php?page=backwpup-settings'

response = requests.get(url, cookies=cookies)
# Extract password from HTML input field
match = re.search(r'<input[^>]*name="s3_password"[^>]*value="([^"]+)"', response.text)
if match:
    print(f"Extracted password: {match.group(1)}")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual access to the wp_options table or the BackWPup settings page.
• Look for repeated attempts to read the backwpup_cfg option via SQL queries.
• Alert on any admin user accessing the settings page outside of normal maintenance windows.

Hardening:

• Immediately upgrade BackWPup to version 4.0.3 or later.
• If upgrade is not possible, manually encrypt the password in the database using a custom plugin or script.
• Restrict administrator access to only trusted users.
• Enable two-factor authentication (2FA) for all admin accounts.
• Regularly audit the wp_options table for plaintext credentials.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/backwpup/inc/class-option.php (or similar) containing plaintext password storage logic.
• Database: wp_options table with option_name = 'backwpup_cfg' containing plaintext passwords.
• Network: Unusual outbound connections to backup destinations (e.g., S3, FTP) from the WordPress server.
• Logs: Admin user accessing /wp-admin/admin.php?page=backwpup-settings with suspicious frequency.

Detection Engineering

YARA Rule

rule CVE_2023_5775_BackWPup_Plaintext_Password {
    meta:
        description = "Detects plaintext password storage in BackWPup plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-5775"
    strings:
        $s1 = "backwpup_cfg" ascii wide nocase
        $s2 = "password" ascii wide nocase
        $s3 = "update_option" ascii wide nocase
    condition:
        all of ($s*) and filesize < 100KB
}

Sigma Rule

title: CVE-2023-5775 BackWPup Plaintext Password Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to BackWPup settings page or database option containing plaintext passwords
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-stem: '/wp-admin/admin.php'
        cs-uri-query: 'page=backwpup-settings'
    condition: selection
falsepositives:
    - Legitimate admin maintenance
level: low

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-5775 BackWPup Settings Access"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=backwpup-settings"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update BackWPup to version 4.0.3 or later, which encrypts passwords before storage.
2. Rotate Credentials: Change all passwords for backup destinations (S3, Dropbox, FTP, etc.) immediately after upgrading.
3. Audit: Review database for any other plaintext credentials stored by the plugin.

Long-term Mitigations:

• Implement a WordPress security plugin that monitors for plaintext storage.
• Use a secrets management solution (e.g., HashiCorp Vault) for external service credentials.
• Enforce least privilege: limit admin accounts and use role-based access control.
• Regularly scan WordPress plugins for known vulnerabilities using tools like WPScan.

Workaround (if upgrade is not possible):

• Manually encrypt the password in the database using a custom function:

  add_action('init', function() {
      $settings = get_option('backwpup_cfg');
      if (!empty($settings['destinations']['S3']['password'])) {
          $settings['destinations']['S3']['password'] = base64_encode(openssl_encrypt($settings['destinations']['S3']['password'], 'aes-256-cbc', wp_salt(), 0, substr(wp_salt('auth'), 0, 16)));
          update_option('backwpup_cfg', $settings);
      }
  });
  

Valters IT
Securing WordPress ecosystems, one plugin at a time.