CVE-2016-20076: WordPress Simple-Backup Path Traversal

CVE-2016-20076 Overview

CVE-2016-20076 affects the WordPress Simple-Backup plugin version 2.7.11. The plugin contains multiple directory traversal vulnerabilities in tools.php that allow unauthenticated attackers to delete and download arbitrary files. Attackers manipulate the delete_backup_file and download_backup_file parameters to traverse the filesystem outside the intended backup directory. Successful exploitation exposes sensitive data such as wp-config.php credentials and database dumps. Attackers can also delete .htaccess files to expose backup directories or destroy critical site files.

Critical Impact
Unauthenticated remote attackers can read sensitive WordPress configuration files including database credentials and delete arbitrary files on the server.

Affected Products

WordPress Simple-Backup plugin version 2.7.11
WordPress installations with the Simple-Backup plugin enabled
Sites where tools.php is reachable from the internet

Discovery Timeline

2026-06-15 - CVE-2016-20076 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2016-20076

Vulnerability Analysis

The Simple-Backup plugin exposes two file operations through tools.php without authentication or input sanitization. The download_backup_file parameter accepts a filename and returns its contents to the requester. The delete_backup_file parameter accepts a filename and removes it from disk. Both handlers concatenate user-supplied input into filesystem paths without validating that the resulting path remains inside the backup directory. This classifies as a path traversal weakness tracked as [CWE-22].

Attackers supply traversal sequences such as ../../../../ to break out of the plugin's working directory. The download endpoint then returns arbitrary readable files, including wp-config.php, which contains database credentials and authentication keys. The delete endpoint removes arbitrary files the web server can write, including .htaccess rules that protect backup archives. With protections removed, attackers harvest backup archives that often contain full database exports.

Root Cause

The root cause is missing input validation on filename parameters. The plugin trusts client-supplied path components and performs no canonicalization or allowlist check against the backup directory. The endpoints also lack capability checks and nonce verification, so any unauthenticated visitor can invoke them.

Attack Vector

Exploitation requires only HTTP access to the vulnerable WordPress site. An attacker sends a GET request to tools.php with a crafted download_backup_file parameter containing relative path traversal sequences pointing to wp-config.php or another sensitive file. A second request using delete_backup_file with a similar traversal payload removes .htaccess from the uploads or backup directory. No credentials, user interaction, or prior compromise are required.

The vulnerability manifests through unsanitized parameter handling in tools.php. See the Exploit-DB entry #39883 and the VulnCheck advisory on the WordPress Simple-Backup flaw for technical details.

Detection Methods for CVE-2016-20076

Indicators of Compromise

HTTP requests to tools.php containing the parameters download_backup_file or delete_backup_file
Parameter values containing ../ sequences or absolute paths such as wp-config.php
Missing .htaccess files in wp-content/uploads/ or plugin backup directories
Outbound responses from tools.php containing strings such as DB_PASSWORD or AUTH_KEY

Detection Strategies

Inspect web server access logs for requests targeting tools.php with traversal patterns in query strings
Deploy WAF rules that block ../ and URL-encoded traversal sequences in download_backup_file and delete_backup_file parameters
Monitor file integrity for .htaccess removal events under wp-content/ directories
Correlate plugin endpoint access with anomalous response sizes consistent with wp-config.php exfiltration

Monitoring Recommendations

Alert on any access to Simple-Backup plugin endpoints from external IP addresses
Track file deletion events on protected WordPress directories using filesystem auditing
Review WordPress plugin inventory for the presence of Simple-Backup 2.7.11
Hunt historical logs for past exploitation attempts using the parameter names above

How to Mitigate CVE-2016-20076

Immediate Actions Required

Disable and remove the Simple-Backup plugin from all WordPress installations
Rotate WordPress database credentials and authentication salts in wp-config.php
Restore any deleted .htaccess files protecting backup or upload directories
Audit backup archives that may have been downloaded by unauthorized parties

Patch Information

No vendor patch is referenced in the available advisory data. The Simple-Backup plugin version 2.7.11 should be considered abandoned for security purposes. Replace it with a maintained backup solution that enforces authentication and validates file paths.

Workarounds

Block external access to wp-content/plugins/simple-backup/tools.php at the web server or WAF layer
Add Deny from all rules in .htaccess for the plugin directory until removal is complete
Move backup archives outside the web root so they cannot be served over HTTP
Apply strict file permissions so the web server user cannot delete .htaccess or read wp-config.php unnecessarily

bash

# Apache configuration to block access to the vulnerable endpoint
<Files "tools.php">
    Require all denied
</Files>

# Or block the plugin directory entirely
<Directory "/var/www/html/wp-content/plugins/simple-backup">
    Require all denied
</Directory>