PT-2025-29319 · Boldgrid+1 · The Total Upkeep – Wordpress Backup Plugin Plus Restore & Migrate+1

Wadeek · Published 2025-07-12 · Updated 2025-07-29 · CVE-2020-36848

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid versions through 1.14.9

Description: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is susceptible to sensitive information exposure through the env-info.php and restore-info.json files. This allows unauthenticated attackers to discover the location of backup files and download them.

Recommendations: Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to a version later than 1.14.9.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-36848

Affected Products

The Total Upkeep – Wordpress Backup Plugin Plus Restore & Migrate

Wordpress

References · 11

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/wp_total_upkeep_downloader.rb · Exploit
• 🔥 https://wpscan.com/vulnerability/d35c19d9-8586-4c5b-9a01-44739cbeee19 · Exploit
• https://plugins.trac.wordpress.org/changeset/2439376/boldgrid-backup · Patch
• https://osv.dev/vulnerability/CVE-2020-36848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36848 · Security Note
• https://twitter.com/CVEnew/status/1944010808645636491 · Twitter Post
• https://twitter.com/cracbot/status/1945800717710803207 · Twitter Post
• https://t.me/cvenotify/128696 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/86a5adaf-02b7-4b42-a048-8bc01f07656b?source=cve · Note
• https://t.me/cvetracker/27636 · Telegram Post
• https://t.me/cveNotify/130183 · Telegram Post