WordPress Plugin Vulnerabilities

Total Upkeep < 1.16.7 - Authenticated (Administrator+) Remote Code Execution via Backup Settings

Description

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

Affects Plugins

Fixed in 1.16.7

References

Classification

Type
COMMAND INJECTION
OWASP top 10
CWE
CVSS

Miscellaneous

Original Researcher
Jonas Benjamin Friedli
Verified
No

Timeline

Publicly Published
2024-11-26 (about 1 year ago)
Added
2024-11-26 (about 1 year ago)
Last Updated
2024-11-26 (about 1 year ago)

Other