Total Upkeep EUVD-2026-57087

No special conditions are required for the information disclosure path: the backup authorization secret is accessible to unauthenticated remote attackers (AV:N/AC:L/PR:N/UI:N) against any default installation of Total Upkeep before 1.17.3 on a network-reachable WordPress site. The forced site-restore capability is equally accessible once the secret is obtained, requiring no additional authentication or elevated privileges. Limiting factors are: the Total Upkeep plugin must be installed and active on the target WordPress site (not merely present but deactivated), and the WordPress site must be reachable over the network. No non-default configuration is required to be vulnerable - the secret exposure is a condition of running any version prior to 1.17.3.

The NVD-provided CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is assessed as materially incomplete: the CVE description explicitly states attackers can force a full site restore that overwrites live site files and the database, which maps to I:H and A:H impacts not reflected in the official score. An independent assessment places this closer to 9.8 Critical. EPSS at 16% sits well above the typical base rate and signals meaningful near-term exploitation probability. SSVC rates exploitation status as poc (public exploit exists) and the attack as automatable with partial technical impact - consistent with mass-scan campaigns against WordPress deployments. There is no CISA KEV entry at time of analysis, so active in-the-wild exploitation is not confirmed, though the public PoC from WPScan and automatable attack profile represent a credible escalation path. Backup plugins are high-value targets because their archives consolidate credentials, source code, and PII in a single downloadable artifact; the forced-restore capability adds site takeover to the threat model. Defenders should treat this as Critical severity rather than the NVD-stated High.

An unauthenticated attacker runs an automated scanner against WordPress sites, identifies installations running Total Upkeep below 1.17.3, and retrieves the exposed authorization secret from an unprotected endpoint - a step fully automatable per SSVC. Using the secret, the attacker downloads the latest backup archive, extracting database credentials, WordPress secret keys, and all site source code from a single request. With the same secret, the attacker can then trigger a full site restore - replacing the live site's files and database with a crafted or older version - effectively taking over the site without any authentication. The publicly available PoC on WPScan enables this entire chain to be scripted.