PT-2025-40471 · Backupbolt · Backup Bolt

Jonas Benjamin Friedli · Publicado 2025-10-03 · Atualizado 2025-10-03 · CVE-2025-10306

NVD

CVSS v3.1

3.8

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process backup batch() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download directories outside of the webroot and write backup zip files to arbitrary locations.

Correção

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

CVE-2025-10306

Produtos afetados

Backup Bolt

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-10306 · Nota de Segurança
• https://wordpress.org/plugins/backup-bolt · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/63f38644-a021-407a-9882-2c8435849c08?source=cve · Nota