# CVE-2020-37246: Supsystic Backup local file inclusion and arbitrary file deletion

Source: https://junglewise.ai/threats/cve-2020-37246-supsystic-backup-local-file-inclusion-and-arbitrary-file-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-16. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2020-37246 · Severity: medium · CVSS 6.2 · Published 2026-05-16

Supsystic Backup, a WordPress plugin used for site backups, contains a security flaw that allows unauthorized individuals to read or delete sensitive files on the web server. By manipulating file paths, an attacker could access critical system information like passwords or disrupt operations by deleting essential files. This could lead to a full compromise of the website's data and availability.

Vendors: [Supsystic](https://junglewise.ai/threats/vendors/supsystic).

## Quick answers

**Is CVE-2020-37246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37246 being exploited in the wild.

**How severe is CVE-2020-37246?** Medium severity, with a CVSS score of 6.2, published 16 May 2026.

**Which products and versions are affected?** Supsystic Backup by Supsystic 2.3.9 and earlier.

**Is there a fix for CVE-2020-37246?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-37246 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2020-37246?** Check whether you run Supsystic Backup by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local file inclusion (LFI) vulnerability exists in Supsystic Backup 2.3.9 due to improper validation of the 'download' and 'filename' parameters in admin.php. An unauthenticated attacker can use directory traversal sequences (e.g., ../) to bypass intended directory restrictions. This allows for the reading of sensitive system files like /etc/passwd via the 'download' parameter or the deletion of arbitrary files via the 'removeAction' AJAX request. The vulnerability was disclosed after the vendor failed to respond to multiple notifications, leading to the plugin being closed by the WordPress Security team.

## Affected products

- Supsystic Backup by Supsystic 2.3.9 and earlier

## Timeline

- 2020-07-24: disclosed: Vulnerability discovered by researcher Erik David Martin
- 2020-07-25: other: Vendor notified of the vulnerability
- 2020-12-01: other: Plugin closed by WordPress Security team due to lack of vendor response
- 2021-02-08: other: Public exploit published on Exploit-DB
- 2026-05-16: advisory: CVE published to NVD

## References

- [https://downloads.wordpress.org/plugin/backup-by-supsystic.zip](https://downloads.wordpress.org/plugin/backup-by-supsystic.zip)
- [https://supsystic.com/](https://supsystic.com/)
- [https://www.exploit-db.com/exploits/49545](https://www.exploit-db.com/exploits/49545)
- [https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion](https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion)