What the vulnerability does
01Description
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.
Explanation of Vulnerability in Simple Terms
02Summary
Simple Backup versions 2.7.11 and earlier contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server through specially crafted requests. An attacker can access sensitive files outside the intended backup directory, potentially exposing configuration files, database credentials, or other confidential data stored on the server.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server without authentication.
Potential impact on your site
04Site Impact
Attackers can access sensitive files like wp-config.php, database backups, or private keys without logging in.
Conditions required to exploit
05Prerequisites
Network access to the vulnerable Simple Backup installation; no authentication or user interaction required.
Key dates
06Disclosure timeline
June 15, 2026
CVE published
June 15, 2026
Record updated
