Critical vulnerability identified in WordPress plugin “BackupBuddy”: (CVE-2022-31474)

This vulnerability is currently being actively exploited with over five million attempts to exploit having been recorded so far.

The flaw exists within the WordPress plugin BackupBuddy (https://ithemes.com/backupbuddy/) and any WordPress instances with the plugin installed may be affected. This vulnerability allow an unauthenticated attacker to view the contents of any file on the affected server that can could be read by your WordPress installation. This may include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd.”

Affected Versions

• 8.5.8.0 to 8.7.4.1

Remediation

This issue has been remediated in version 8.7.5, all users of the BackupBuddy plugin are advised to upgrade to the latest version available.

References

• https://ithemes.com/blog/wordpress-vulnerability-report-special-edition-september-6-2022-backupbuddy/
• https://www.wordfence.com/blog/2022/09/psa-nearly-5-million-attacks-blocked-targeting-0-day-in-backupbuddy-plugin/

AI apps are smart. Until they do something really dumb.

AI apps seem brilliant—until they expose secrets or spill user data without a clue. Behind the curtain? Chaos. Hackers, take aim.

CovertSwarm Ranks #23 on Clutch 100 Fastest-Growing Companies in 2025

Clutch has recognized us for achieving one of the highest revenue growth rates from 2023 to 2024.

CovertSwarm Achieves Prestigious CBEST Accreditation

CovertSwarm becomes one of the few cybersecurity firms accredited under the Bank of England’s rigorous CBEST framework.