WordPress BatchMove Plugin Information Disclosure Scanner

The WordPress BatchMove Plugin is a utility used by site administrators and developers to manage database backups efficiently, particularly for sites handling large data changes. It integrates into WordPress to streamline backup generation, helping prevent data loss during updates. The plugin is open-source, encouraging community contributions to enhance its functionality and security.

The Information Disclosure vulnerability in the WordPress BatchMove Plugin v1.5 arises from inadequate access controls on backup files. This flaw allows unauthorized users to access sensitive database information by exploiting predictable file paths or missing authentication checks. The root cause is the exposure of backup files without proper safeguards, making them accessible to anyone who knows the URL.

Technically, the vulnerability targets the endpoint where backup files are stored, typically under a predictable directory like /wp-content/uploads/batchmove/. Attackers can enumerate or directly access these files, downloading database dumps containing sensitive data such as user credentials, emails, and site configurations. No authentication is required to trigger this disclosure.

If exploited, an attacker can gain access to the entire WordPress database, leading to data breaches, account takeovers, and potential site compromise. This can result in loss of user trust, legal liabilities, and significant damage to the site's reputation. Immediate remediation is critical to prevent unauthorized data exposure.