EUVD-2025-32544
3.8
CVSS 3.1
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Lifecycle Timeline
3
Analysis Generated
Mar 13, 2026 - 19:29 vuln.today
EUVD ID Assigned
Mar 13, 2026 - 19:29 euvd
EUVD-2025-32544
CVE Published
Oct 03, 2025 - 12:15 nvd
LOW 3.8
DescriptionNVD
The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to download directories outside of the webroot and write backup zip files to arbitrary locations.
AnalysisAI
A arbitrary file access vulnerability in Backup Bolt (CVSS 3.8). Remediation should follow standard vulnerability management procedures.
Technical ContextAI
Vulnerability type: arbitrary file access. Affects Backup Bolt.
RemediationAI
Monitor vendor channels for patch availability.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).