Backup by Supsystic <= 2.3.9 - Authenticated Arbitrary File Download and Deletion

Description

The plugin does not check for path traversal attacks, allowing administrator to download and delete any file from the web server. Due to the lack of CSRF check on the file deletion, unauthenticated attacker could make a logged in administrator delete files from the web server as well