PT-2025-39517 · WordPress · Backuply

Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-10307

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Backuply – Backup, Restore, Migrate and Clone plugin for WordPress versions through 1.4.8

Description The Backuply plugin for WordPress is susceptible to arbitrary file deletion because of inadequate file path validation within the delete backup functionality. An authenticated attacker with Administrator-level access or higher can delete any file on the server. Deleting specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Update the Backuply plugin to a version later than 1.4.8.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-10307

Affected Products

Backuply

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10307 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0dd53fad-1bd7-41ed-95cb-205a9b421724?source=cve · Note
• https://t.me/CVEtracker/33426 · Telegram Post
• https://twitter.com/CVEnew/status/1971467045947465915 · Twitter Post
• https://t.me/cveNotify/136504 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363283%40backuply&new=3363283%40backuply&sfp_email=&sfph_mail= · Note