Is CVE-2026-16253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16253 being exploited in the wild.

How severe is CVE-2026-16253?

High severity, with a CVSS score of 7.5, published 12 August 2026.

Which products and versions are affected?

BoldGrid Total Upkeep before 1.17.3.

Is there a fix for CVE-2026-16253?

A patch was published on 2026-08-12: Version 1.17.3 released; note that existing affected sites remain at risk until secrets are manually reset Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16253 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-16253?

Check whether you run BoldGrid Total Upkeep at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16253: Bolder Backup Total Upkeep authentication bypass in backup restore

CVE-2026-16253 · Severity: high · CVSS 7.5 · Published 2026-08-12

The Total Upkeep WordPress backup plugin fails to properly secure the authorization token for its backup and restore features, exposing it to unauthenticated users. An attacker can retrieve sensitive backup metadata, including the private restore token, and use it to force a complete site restoration—overwriting all live files and databases with backup data. This represents a complete loss of control over the live site and potential data loss or replacement with stale/malicious backups.

Vendors: BoldGrid.

Quick answers

Is CVE-2026-16253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16253 being exploited in the wild.
How severe is CVE-2026-16253?: High severity, with a CVSS score of 7.5, published 12 August 2026.
Which products and versions are affected?: BoldGrid Total Upkeep before 1.17.3.
Is there a fix for CVE-2026-16253?: A patch was published on 2026-08-12: Version 1.17.3 released; note that existing affected sites remain at risk until secrets are manually reset Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16253 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-16253?: Check whether you run BoldGrid Total Upkeep at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incomplete fix for CVE-2020-36848 affecting an authentication bypass in the backup-restore mechanism. The plugin stores a backup restore authorization token (cron_secret) in a JSON configuration file accessible at `/wp-content/plugins/boldgrid-backup/cron/restore-info-*.json` without proper access controls, allowing unauthenticated HTTP GET requests to leak the secret. An attacker can then use the leaked restore ID and secret to send an unauthenticated POST request to the `boldgrid_backup_run_restore` AJAX endpoint, which validates only the secret—not user authentication—permitting a forced full site restoration. The attack requires a backup to exist (which is created by default) and is network-accessible with no user interaction. The fix in v1.17.3 only protects new sites; existing affected installations retain exposed secrets and remain at risk until manually reset.

Affected products

BoldGrid Total Upkeep before 1.17.3

Timeline

2026-08-10: disclosed
2026-08-12: patched: Version 1.17.3 released; note that existing affected sites remain at risk until secrets are manually reset

References

https://wpscan.com/vulnerability/97abf25a-48d4-4dfa-a7a3-de88455be7eb/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.