Wp Backitup Community Edition
Monthly
Directory traversal in WP BackItUp Community Edition (WordPress plugin) ≤2.1.0 allows authenticated administrators to read the contents of arbitrary existing files on the server via the backup_file parameter in the download handler. The handler applies basename() normalization only when the traversal target path does not exist - meaning any real file, including wp-config.php or OS credential files, is returned without sanitization. No public exploit code has been identified at time of analysis, and the PR:H requirement limits the exploitable attack surface to accounts with WordPress administrator privileges or higher.
Directory traversal in WP BackItUp Community Edition (WordPress plugin) ≤2.1.0 allows authenticated administrators to read the contents of arbitrary existing files on the server via the backup_file parameter in the download handler. The handler applies basename() normalization only when the traversal target path does not exist - meaning any real file, including wp-config.php or OS credential files, is returned without sanitization. No public exploit code has been identified at time of analysis, and the PR:H requirement limits the exploitable attack surface to accounts with WordPress administrator privileges or higher.