CVE-2020-36848highCWE-200

CVE-2020-36848: high-severity vulnerability in boldgrid Total Upkeep – WordPress Backup…

Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download

Published · Updated

Follow this CVE+ Monitor Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 1.9%
from disclosure to weaponsame day
Published on NVDJul 12
metasploitDec 12
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
boldgrid · Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Related CVEs — boldgrid Total Upkeep – WordPress Backup…

In the same product, most dangerous first.

CVE-2024-9461HIGHTotal Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup SettingsEPSS 1.0%CVE-2025-2257HIGHTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command InjectionEPSS 0.9%CVE-2022-4932MEDIUMTotal Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information DisclosureEPSS 0.6%CVE-2024-13907MEDIUMTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request ForgeryEPSS 0.5%CVE-2026-3143MEDIUMTotal Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback CancellationEPSS 0.3%