Backup by Supsystic <= 2.3.9 - Authenticated Arbitrary File Download and Deletion

The plugin does not check for path traversal attacks, allowing administrator to download and delete any file from the web server. Due to the lack of CSRF check on the file deletion, unauthenticated attacker could make a logged in administrator delete files from the web server as well

The PoC will be displayed once the issue has been remediated