CVE-2011-4342

PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.

• CWE-94

• http://packetstormsecurity.org/files/view/99799/SOS-11-003.txtExploit
• http://seclists.org/fulldisclosure/2011/Mar/328Exploit
• http://secunia.com/advisories/43565Vendor Advisory
• http://wordpress.org/support/topic/plugin-backwpup-remote-and-local-codeexecution-vulnerability-sos-11-003
• http://www.exploit-db.com/exploits/17056Exploit
• http://www.openwall.com/lists/oss-security/2011/11/22/10Exploit
• http://www.openwall.com/lists/oss-security/2011/11/22/7Exploit
• http://www.osvdb.org/71481Exploit
• http://www.senseofsecurity.com.au/advisories/SOS-11-003.pdfExploit, URL Repurposed
• http://packetstormsecurity.org/files/view/99799/SOS-11-003.txtExploit
• http://seclists.org/fulldisclosure/2011/Mar/328Exploit
• http://secunia.com/advisories/43565Vendor Advisory
• http://wordpress.org/support/topic/plugin-backwpup-remote-and-local-codeexecution-vulnerability-sos-11-003
• http://www.exploit-db.com/exploits/17056Exploit
• http://www.openwall.com/lists/oss-security/2011/11/22/10Exploit
• http://www.openwall.com/lists/oss-security/2011/11/22/7Exploit
• http://www.osvdb.org/71481Exploit
• http://www.senseofsecurity.com.au/advisories/SOS-11-003.pdfExploit, URL Repurposed

Published

Oct 8, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4336Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" param…6.1
• CVE-2011-4337Static code injection vulnerability in translate.php in Supp…
• CVE-2011-4338Shaman 1.0.9: Users can add the line askforpwd=false to his …7.8
• CVE-2011-4339ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in …
• CVE-2011-4340Multiple cross-site scripting (XSS) vulnerabilities in Symph…
• CVE-2011-4341Multiple SQL injection vulnerabilities in symphony/content/c…
• CVE-2011-4343Information disclosure vulnerability in Apache MyFaces Core …
• CVE-2011-4344Cross-site scripting (XSS) vulnerability in Jenkins Core in …
• CVE-2011-4345Cross-site scripting (XSS) vulnerability in Namazu before 2.…
• CVE-2011-4346Cross-site scripting (XSS) vulnerability in the web interfac…
• CVE-2011-4347The kvm_vm_ioctl_assign_device function in virt/kvm/assigned…
• CVE-2011-4348Race condition in the sctp_rcv function in net/sctp/input.c …