PT-2026-41446 · WordPress · Supsystic Backup

Published 2026-05-16 · Updated 2026-05-16 · CVE-2020-37246

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Supsystic Backup version 2.3.9

Description An issue allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. By using directory traversal sequences in requests to the 'admin.php' endpoint, attackers can access sensitive files such as /etc/passwd or delete files through the removeAction parameter. Directory traversal is a technique that uses special characters to access files and directories outside the intended folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2020-37246

Affected Products

Supsystic Backup

References · 6

• 🔥 https://exploit-db.com/exploits/49545 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37246 · Security Note
• https://supsystic.com · Note
• https://downloads.wordpress.org/plugin/backup-by-supsystic.zip · Note
• https://t.me/CVEtracker/54000 · Telegram Post
• https://vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion · Note