CVE-2023-6750 is a high severity (CVSS 7.5) flaw in the Clone WordPress plugin before 2.4.3. It stores in-progress backup data at a public, fixed path. Update to 2.4.3 or later, and treat any backup taken while the site was exposed as potentially read.
What's affected
The record and the WPScan entry say versions before 2.4.3 are affected, and 2.4.3 is the fixed version. The plugin slug is wp-clone-by-wp-academy. WPScan lists the researcher as Dmitrii Ignatyev.
The issue only matters while a backup job is running, because the temporary files exist during that window. Sites that run backups often, or on a schedule that overlaps with traffic, have more chances for exposure.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get wp-clone-by-wp-academy --field=version
Any version below 2.4.3 is affected. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
Also look in the uploads directory for a folder created by the plugin. Leftover buffer files from interrupted jobs are worth deleting.
What to do now
- Update the plugin:
wp plugin update wp-clone-by-wp-academy, or use the Plugins screen. The fixed version is 2.4.3. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Delete stale backup and buffer files from the uploads directory, and move finished backups out of web-reachable folders.
Why it matters
The cause is a design choice: working files that hold backup information were written to a static, web-reachable location. Anyone who knew the pattern could request them while a job was in flight. The record lists no CWE, and WPScan classifies it as sensitive data disclosure.
Backups contain the whole database, which usually means user records, hashed passwords and keys. Backup tooling needs the same access control as the database itself. Write temporary files outside the web root, or deny web access to the folder.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Quick check
Is this the same as leaving old backup files on the server?
It is related but different. This flaw is about temporary files created during a running backup. Old finished backups are a separate exposure, and both are worth cleaning up.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
