Executive brief
Simple Backup is a WordPress plugin used to create and manage website backups. A security flaw in version 2.7.11 allows unauthorized individuals to remotely delete or download sensitive files from the web server without logging in. This could lead to the theft of database credentials, customer data, and website configuration files, or cause a complete site outage by deleting critical system files.
Technical details
The WordPress Simple-Backup plugin (v2.7.11 and below) suffers from multiple path traversal vulnerabilities due to insufficient input validation in the 'delete_backup_file' and 'download_backup_file' parameters within tools.php. An unauthenticated remote attacker can exploit these flaws by supplying crafted directory traversal sequences (e.g., ../) to access or delete files outside of the intended backup directory. This allows for the retrieval of sensitive files like wp-config.php or /etc/passwd, and the deletion of critical files such as .htaccess, which can further expose the backup directory to public browsing. The root cause is the use of weak sanitization (ltrim) instead of robust path handling like the PHP basename() function.
Affected products
- WordPress Simple Backup 2.7.11 and earlier
Timeline
- 2016-02-21: other: Initial vendor contact attempt
- 2016-03-10: other: WordPress security team acknowledged the report
- 2016-06-02: disclosed: Public disclosure by researcher due to lack of vendor response
- 2026-06-15: advisory: NVD publication of CVE-2016-20076