Total Upkeep CVE-2026-66708

No special conditions are required beyond the target WordPress site having Total Upkeep version 1.17.2 or earlier installed and active as a plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation against default plugin configurations with no complexity barrier. The plugin does not need to be in any specific operational mode; normal installation is sufficient. What limits exploitation is the need for the specific plugin to be present and active - sites not running Total Upkeep are unaffected. The scope is limited to WordPress environments (not applicable to non-WordPress deployments), and the absence of confidentiality impact (C:N) means attackers cannot use this flaw alone to extract backup archives or credentials.

The CVSS base score of 8.2 is well-supported by the vector components: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), yielding high availability and low integrity impact. EPSS data is not present in the provided intelligence, so exploitation probability cannot be quantified probabilistically. The vulnerability is not listed in CISA KEV, and no POC is referenced, meaning active exploitation is not confirmed. However, the low attack complexity and zero-privilege requirement make this trivially automatable - a scanner or bot could mass-identify and exploit vulnerable WordPress instances. The primary real-world risk is destruction of backup archives, which is especially dangerous if Total Upkeep is the sole recovery mechanism. Organizations relying on this plugin for disaster recovery face compounded risk: a ransomware or destructive attack could follow an exploitation that pre-emptively wipes backups. The absence of a confidentiality impact limits data-exfiltration risk but does not diminish the availability threat.

An unauthenticated attacker discovers a WordPress site running Total Upkeep via WPScan or HTTP response fingerprinting, then sends a crafted POST request directly to the vulnerable plugin endpoint - no session cookie, nonce, or credentials required. The missing authorization check (CWE-862) allows the request to proceed, and the attacker triggers deletion or overwrite of all existing backup archives. If the organization later experiences a ransomware event, the pre-wiped backups render recovery impossible, amplifying the original attack's impact.