PT-2025-45563 · WordPress · Cyan Backup

Quy Nguyen · Published 2025-11-08 · Updated 2025-11-08 · CVE-2025-12092

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions CYAN Backup plugin for WordPress versions through 2.5.4

Description The CYAN Backup plugin for WordPress has a flaw that allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. This is due to inadequate validation of file paths within the 'delete' functionality. Deleting specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Update the CYAN Backup plugin to a version newer than 2.5.4.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12092

Affected Products

Cyan Backup

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12092 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12092 · Vendor Advisory
• https://github.com/toolstack/cyan-backup/commit/4a79d23e8ba330b5cb655a083c6a00ef32a7b249 · Note
• https://plugins.trac.wordpress.org/changeset/3390065/cyan-backup/tags/2.5.5/includes/page-backups.php · Note
• https://t.me/CVEtracker/36864 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/39972b06-920f-48b0-aa36-bb5caab87cb6?source=cve · Note
• https://twitter.com/CVEnew/status/1987092888816394629 · Twitter Post
• https://t.me/cveNotify/142210 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1987143559539998920 · Twitter Post