CVE-2025-10307: falha de média gravidade em softaculous Backuply – Backup, Restore…
Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.7%
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
softaculous · Backuply – Backup, Restore, Migrate and CloneCVEs relacionadas — softaculous Backuply – Backup, Restore…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-8669CRITICALBackuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL InjectionEPSS 16.6%CVE-2024-0842HIGHBackuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of ServiceEPSS 1.0%CVE-2024-2294MEDIUMBackuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory TraversalEPSS 0.9%CVE-2024-0697MEDIUMBackuply – Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory TraversalEPSS 0.8%CVE-2026-93953HIGHBackuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege EscalationEPSS 0.3%