# CVE-2023-6750: Clone - Information Disclosure

> Live exploitation tracking for CVE-2023-6750 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-6750

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** N/A Clone
- **Tags:** wordpress, cms

## Description

The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.

## CrowdSec analysis

[CVE-2023-6750](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-6750) is an information disclosure vulnerability in the Clone WordPress plugin prior to version 2.4.3, where backup information is stored in buffer files at a publicly accessible, static file path. This flaw could allow remote attackers to access sensitive backup data without authentication, potentially exposing confidential site information.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

CrowdSec network data shows that most actors exploiting CVE-2023-6750 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2023-6750 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by directly requesting backup files such as `/wp-content/uploads/wp-clone/wpclone_backup/database.sql` or `/wp-content/uploads/wp-clone/wpclone_backup/prefix.txt`, exposing sensitive WordPress database contents without authentication.

## Timeline

- 2024-01-08: CVE Published. CVE-2023-6750 is published to NVD.
- 2026-05-22: Rule Released. CrowdSec releases a rule to detect CVE-2023-6750 exploitation attempts against the CrowdSec Network.
- 2026-06-04: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-6750 for the first time.

## References

- https://wpscan.com/vulnerability/fad9eefe-4552-4d20-a1fd-bb2e172ec8d7
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6750.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-6750) follows observed exploitation activity for CVE-2023-6750. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.