What the vulnerability does
01Description
The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This only affects instances running PHP 7.1 or older.
Explanation of Vulnerability in Simple Terms
02Summary
Bei Fen WordPress Backup Plugin versions 1.4.2 and earlier contain a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service availability. The attack requires specific conditions to be met but does not require authentication or user interaction. Site administrators should update to a version newer than 1.4.2 as soon as possible.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or disrupt service availability without authentication.
Potential impact on your site
04Site Impact
Backup plugin compromise could expose database contents, allow unauthorized modifications, or cause downtime.
Conditions required to exploit
05Prerequisites
Network access; specific attack complexity conditions must be met.
Key dates
06Disclosure timeline
September 30, 2025
CVE published
April 8, 2026
Record updated
