WordPress Plugin Vulnerabilities

Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret (regression of CVE-2020-36848)

Description

The plugin does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.

Proof of Concept

Affects Plugins

Plugin icon
boldgrid-backup
Fixed in 1.17.3

References

CVE
CVE-2026-16253

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
7.7 (high)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://www.jakubherman.net
Verified
Yes
WPVDB ID
97abf25a-48d4-4dfa-a7a3-de88455be7eb

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2026-01-12
Title
EventPrime - Events Calendar, Bookings and Tickets < 4.2.8.0 - Unauthenticated Sensitive Information Exposure via REST API
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing
Published
2023-03-02
Title
WP SMS < 6.0.4.1 - Information Disclosure via REST API
Published
2026-01-08
Title
NextGEN Download Gallery <= 1.6.2 - Unauthenticated Information Exposure
Published
2025-12-15
Title
Fancy Product Designer | WooCommerce WordPress < 6.5.0 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter