EUVD-2026-53911
GHSA-78ff-cccg-866p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Network-reachable with no privileges or interaction; availability high from backup destruction, integrity low from manipulation, no confidentiality exposure confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
AnalysisAI
Unauthenticated broken access control in BoldGrid's Total Upkeep WordPress backup plugin (versions up to and including 1.17.2) permits remote unauthenticated attackers to invoke privileged backup management functions without any authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no prerequisites beyond network reachability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target WordPress site having Total Upkeep version 1.17.2 or earlier installed and active as a plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.2 is well-supported by the vector components: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), yielding high availability and low integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker discovers a WordPress site running Total Upkeep via WPScan or HTTP response fingerprinting, then sends a crafted POST request directly to the vulnerable plugin endpoint - no session cookie, nonce, or credentials required. The missing authorization check (CWE-862) allows the request to proceed, and the attacker triggers deletion or overwrite of all existing backup archives. … |
| Remediation | The primary remediation is to update the Total Upkeep plugin beyond version 1.17.2; however, the exact patched release version is not independently confirmed in the available data - only the ceiling of affected versions (<=1.17.2) is stated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately disable the BoldGrid Total Upkeep plugin or isolate the affected WordPress installation from internet access; audit all backup repositories for evidence of tampering, deletion, or unauthorized access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Total Upkeep
View allThe Total Upkeep WordPress backup plugin through version 1.14.9 exposes backup file locations via env-info.php and resto
Unauthenticated exposure of the backup authorization secret in Total Upkeep WordPress plugin (all versions before 1.17.3
The Total Upkeep - WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remo
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep al
The Total Upkeep - WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remo
The Total Upkeep - WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Serv
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today