Executive brief
WP BackItUp is a WordPress plugin that creates and manages site backups. The plugin contains a directory traversal vulnerability in its backup file download feature that allows administrators to read arbitrary files on the server, potentially exposing sensitive configuration data, database credentials, or other private information. This vulnerability is limited to authenticated users with administrator privileges.
Technical details
The vulnerability is a directory traversal flaw in the 'backup_file' parameter of the backup download handler. The vulnerable code uses basename() normalization, but only applies it when the traversed target path does not exist; existing files bypass this protection entirely. An authenticated attacker with administrator-level access can craft a malicious file path using path traversal sequences (e.g., `../../../etc/passwd`) to read arbitrary files on the server. The attack requires administrator credentials and is delivered via a direct request parameter, making it a network-accessible vulnerability with low barrier to entry for privileged insiders. A patch addressing the normalization logic is expected in versions after 2.1.0.
Affected products
- WP BackItUp BackItUp Community Edition up to and including 2.1.0
Timeline
- 2026-09-10: disclosed