CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
Total Upkeep contains a code injection vulnerability in versions up to 1.16.6. An authenticated administrator can inject and execute arbitrary PHP code on the site through the plugin's functionality. This allows complete control over the WordPress installation, including data theft, malware installation, and site defacement. Update immediately to a version newer than 1.16.6.
What an attacker can do
Run arbitrary PHP code on the site with full administrative privileges.
Potential impact on your site
A compromised admin account can fully compromise your site, steal data, install malware, or deface content.
Conditions required to exploit
Attacker must have administrator-level access to WordPress.
Key dates
External resources
Related vulnerabilities
