Executive brief
Supsystic Backup, a WordPress plugin used for site backups, contains a security flaw that allows unauthorized individuals to read or delete sensitive files on the web server. By manipulating file paths, an attacker could access critical system information like passwords or disrupt operations by deleting essential files. This could lead to a full compromise of the website's data and availability.
Technical details
A local file inclusion (LFI) vulnerability exists in Supsystic Backup 2.3.9 due to improper validation of the 'download' and 'filename' parameters in admin.php. An unauthenticated attacker can use directory traversal sequences (e.g., ../) to bypass intended directory restrictions. This allows for the reading of sensitive system files like /etc/passwd via the 'download' parameter or the deletion of arbitrary files via the 'removeAction' AJAX request. The vulnerability was disclosed after the vendor failed to respond to multiple notifications, leading to the plugin being closed by the WordPress Security team.
Affected products
- Supsystic Backup by Supsystic 2.3.9 and earlier
Timeline
- 2020-07-24: disclosed: Vulnerability discovered by researcher Erik David Martin
- 2020-07-25: other: Vendor notified of the vulnerability
- 2020-12-01: other: Plugin closed by WordPress Security team due to lack of vendor response
- 2021-02-08: other: Public exploit published on Exploit-DB
- 2026-05-16: advisory: CVE published to NVD