Executive brief
The miniOrange Backup and Restore plugin for WordPress contains a security flaw that allows logged-in users to delete files they should not have access to. By sending specially crafted requests, an attacker could delete critical website configuration files or system data, potentially leading to a complete site shutdown or data loss. The plugin has been permanently closed by the author and is no longer available for download, meaning users should migrate to a supported alternative.
Technical details
An arbitrary file deletion vulnerability exists in the miniOrange Backup and Restore plugin (version 1.0.3) for WordPress due to improper path validation. The flaw is located in the AJAX handler 'barfw_backup_ajax_redirect' within the 'delete_backup' call type. Authenticated attackers can send POST requests to 'admin-ajax.php' with manipulated 'file_name' and 'folder_name' parameters to perform path traversal and delete arbitrary files across the WordPress installation directory. This can be used to delete 'wp-config.php', effectively resetting the site and allowing for a new administrative setup. The plugin was permanently closed on the WordPress repository in December 2022 at the author's request.
Affected products
- miniOrange Backup and Restore plugin 1.0.3
Timeline
- 2021-11-07: disclosed: Initial exploit discovery and PoC by Murat DEMIRCI
- 2022-12-25: other: Plugin permanently closed on WordPress.org at author request
- 2026-05-16: advisory: NVD/VulnCheck advisory published