What is the CVSS score of CVE-2025-28954?

CVE-2025-28954 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-28954?

A Cross-Site Request Forgery vulnerability in the Backwp plugin (versions through 2.0.2) could allow attackers to manipulate authenticated users into performing unauthorized actions, potentially…

How to fix or mitigate CVE-2025-28954?

Within 24 hours: Audit all Backwp installations and document affected versions; disable the plugin if not critical to operations. Within 7 days: Implement WAF rules to block suspicious CSRF patterns and monitor for exploitation attempts; evaluate alternative backup solutions. Within 30 days: Contact the vendor for patch timeline; develop migration plan to alternative tools or await official security update.

Wordpress Plugin CVE-2025-28954

EUVD-2025-17169 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress Path Traversal CSRF Wordpress Plugin

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17169

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.4

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp allows Path Traversal. This issue affects Backwp: from n/a through 2.0.2.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in the wphobby Backwp WordPress plugin (versions through 2.0.2) that enables path traversal attacks. An unauthenticated remote attacker can exploit this via a crafted web request to perform unauthorized actions and potentially access sensitive files outside intended directories. While the CVSS score of 7.4 indicates high severity with availability impact, the vulnerability requires user interaction (UI:R) and affects availability rather than confidentiality or integrity, suggesting moderate real-world exploitability.

Technical ContextAI

The vulnerability stems from improper CSRF token validation combined with insufficient input sanitization in the Backwp plugin's request handling mechanism. CWE-352 (Cross-Site Request Forgery) is the primary weakness, allowing attackers to craft malicious requests that are automatically executed in the victim's browser context when they visit attacker-controlled pages. The path traversal component (likely CWE-22) enables directory traversal sequences (e.g., '../../../') to bypass access controls and reach unintended file locations. Backwp, a WordPress backup and migration plugin, handles sensitive file operations, making CSRF+path traversal particularly dangerous. The CPE context indicates this affects the wphobby Backwp product family through version 2.0.2, suggesting the plugin's backup/restore or file management features are compromised.

RemediationAI

patch: Upgrade wphobby Backwp to version 2.0.3 or later (specific patch version not provided in available intelligence; verify via wphobby official repository or WordPress plugin directory) immediate_mitigation: Disable or deactivate the Backwp plugin until a patched version is confirmed available and tested workaround: Implement Web Application Firewall (WAF) rules to block requests with path traversal sequences (../, ..\) and validate CSRF tokens on all state-changing operations workaround: Restrict access to Backwp admin pages via IP allowlisting or authentication gating, reducing user interaction surface detection: Monitor server logs for requests containing path traversal patterns targeting backup/file management endpoints; check WordPress audit logs for unauthorized backup or file access events vendor_advisory: Check wphobby official website, WordPress plugin repository security notices, and WordPress security mailing lists for official patches and advisories