CVE-2025-2257
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
Reserved 2025-03-12 | Published 2025-03-26 | Updated 2025-03-26 | Assigner WordfenceCWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| 2025-03-25: | Disclosed |
Dzmitry Sviatlichny
www.wordfence.com/...-c11b-43b6-9dd0-caa5ccfb90c8?source=cve
plugins.svn.wordpress.org/...admin-compressor-system-zip.php
github.com/BoldGrid/boldgrid-backup/pull/622/files
plugins.trac.wordpress.org/...d-backup&sfp_email=&sfph_mail=
Support options
