WordPress Plugin Vulnerabilities

Backup Bolt < 1.5.0 - Authenticated (Admin+) Arbitrary File Download

Description

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download directories outside of the webroot and write backup zip files to arbitrary locations.

Affects Plugins

Plugin icon
backup-bolt
Fixed in 1.5.0

References

CVE
CVE-2025-10306
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/63f38644-a021-407a-9882-2c8435849c08

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Jonas Benjamin Friedli
Verified
No
WPVDB ID
40bde24b-9286-4700-b55c-a07a48c91ee3

Timeline

Publicly Published
2025-10-02 (about 1 year ago)
Added
2025-10-02 (about 1 year ago)
Last Updated
2025-10-10 (about 1 year ago)

Other

Published
Title
Published
2026-04-21
Title
HTTP Headers < 1.19.3 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
Published
2026-06-16
Title
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
Published
2025-12-17
Title
Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion
Published
2026-08-03
Title
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips
Published
2026-07-16
Title
Kirki < 6.0.14 - Editor+ Path Traversal to Arbitrary Directory Deletion via family