CVE-2022-4932mediumCWE-862

CVE-2022-4932: fallo de gravedad media en boldgrid Total Upkeep – WordPress Backup…

Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.6%
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
boldgrid · Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
CVEs relacionadas — boldgrid Total Upkeep – WordPress Backup…

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-36848HIGHTotal Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup DownloadEPSS 1.9%CVE-2024-9461HIGHTotal Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup SettingsEPSS 1.0%CVE-2025-2257HIGHTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command InjectionEPSS 0.9%CVE-2024-13907MEDIUMTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request ForgeryEPSS 0.5%CVE-2026-3143MEDIUMTotal Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback CancellationEPSS 0.3%