cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIGtarpath (3) $exclude (4) $_CONFIG'tarcompress' (5) $_CONFIG'filename' (6) $_CONFIG'exfile_tar' (7) $_CONFIGsqldump (8) $_CONFIG'mysql_host' (9) $_CONFIG'mysql_pass' (10) $_CONFIG'mysql_user' (11) $database_name or (12) $sqlfile variable.