PT-2026-49214 · Undefined · Undefined

Published 2026-06-15 · Updated 2026-06-15 · CVE-2016-20076

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete backup file and download backup file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-20076

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-20076 · Security Note
• https://exploit-db.com/exploits/39883 · Note
• https://vulncheck.com/advisories/wordpress-simple-backup-arbitrary-file-deletion-and-download · Note