PT-2025-39952 · WordPress · Bei Fen – Wordpress Backup Plugin

Aril Aprilio · Published 2025-09-30 · Updated 2025-10-05 · CVE-2025-9993

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bei Fen – WordPress Backup Plugin versions through 1.4.2

Description The Bei Fen – WordPress Backup Plugin for WordPress is susceptible to Local File Inclusion through the task parameter. Attackers with Subscriber-level access or higher can include and execute arbitrary .php files on the server. This could allow bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads and inclusion are permitted. This issue affects systems running PHP 7.1 or older.

Recommendations Update Bei Fen – WordPress Backup Plugin to a version later than 1.4.2. For systems running PHP 7.1 or older, consider upgrading to a newer PHP version.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-9993

Affected Products

Bei Fen – Wordpress Backup Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9993 · Security Note
• https://t.me/CVEtracker/33718 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/839c3b99-189d-4a74-b295-d44eb39d86c8?source=cve · Note
• https://plugins.trac.wordpress.org/browser/bei-fen/trunk/beifen.php#L185 · Note
• https://plugins.svn.wordpress.org/bei-fen/trunk/beifen.php · Note
• https://twitter.com/CVEnew/status/1972878684433301910 · Twitter Post
• https://twitter.com/cracbot/status/1974791729942274157 · Twitter Post