/Vulnerability Library

JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing

CVE-2023-7165
Verified

Description

JetBackup WordPress plugin <= 2.0.9.9 does not use index files to prevent directory listing in certain configurations, letting malicious actors leak backup files, exploit requires access to the web server.

Severity

High

CVSS Score

7.5

Exploit Probability

2%

Affected Product

jetbackup

Published Date

April 9, 2026

Template Author

pussycat0x

CVE-2023-7165.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2023-7165
CWE ID:
cwe-548

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/backup/jetbackup-wp-backup-migrate-restore-2097-sensitive-information-exposure-via-directory-listinghttps://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/https://plugins.trac.wordpress.org/changeset/3016772/backup

Remediation Steps

Update to version 2.0.9.9 or later that implements index files to prevent directory listing.