CVE-2020-37246: Supsystic Backup Path Traversal Flaw

CVE-2020-37246 Overview

CVE-2020-37246 is a local file inclusion (LFI) vulnerability in the Supsystic Backup WordPress plugin version 2.3.9. The flaw resides in the plugin's admin.php endpoint, where the download parameter is concatenated into file system operations without sanitization. Unauthenticated attackers can supply directory traversal sequences to read arbitrary files such as /etc/passwd from the underlying host. The same parameter handling enables arbitrary file deletion when combined with the removeAction parameter. The issue is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated attackers can read and delete arbitrary files on WordPress servers running Supsystic Backup 2.3.9, exposing credentials, configuration data, and enabling site disruption.

Affected Products

Supsystic Backup WordPress plugin version 2.3.9
WordPress installations bundling the backup-by-supsystic plugin
Web servers hosting the vulnerable plugin with default file permissions

Discovery Timeline

2026-05-16 - CVE-2020-37246 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2020-37246

Vulnerability Analysis

The Supsystic Backup plugin exposes administrative actions through admin.php requests that accept a download parameter referencing backup archives. The plugin trusts the supplied path and passes it directly to file read and delete routines without validating that the value remains inside the plugin's backup directory. An attacker can submit traversal sequences such as ../../../../etc/passwd to escape the intended directory. The handler then returns the contents of the targeted file in the HTTP response.

The same parameter feeds the deletion branch when removeAction is invoked. This permits an attacker to remove any file the web server user can access, including WordPress core files, .htaccess, and plugin assets. Because the endpoint does not enforce authentication or capability checks, exploitation requires no credentials.

Root Cause

The root cause is unsanitized user input used in PHP file inclusion and file system operations. The plugin neither canonicalizes the supplied path nor verifies that it resolves within the expected backup directory. This pattern aligns with [CWE-98], where filename inputs are improperly controlled in file inclusion logic.

Attack Vector

An attacker issues an HTTP request to the WordPress admin.php endpoint exposed by the plugin, supplying a traversal payload in the download parameter. For file disclosure, the response body contains the contents of the targeted file. For file removal, the attacker appends removeAction to delete the referenced file. No authentication, user interaction, or special privileges are required, though network access to the target site is needed. Public exploit code is referenced in Exploit-DB #49545.

Detection Methods for CVE-2020-37246

Indicators of Compromise

HTTP requests to admin.php containing download= parameters with ../ traversal sequences
Requests referencing sensitive paths such as /etc/passwd, wp-config.php, or .htaccess in the download parameter
Presence of the removeAction parameter combined with traversal payloads in plugin requests
Unexpected deletion of WordPress core or plugin files coinciding with web access log entries to the Supsystic endpoint

Detection Strategies

Inspect web server access logs for admin.php requests containing URL-encoded traversal patterns (%2e%2e%2f, ..%2f, ../)
Deploy web application firewall (WAF) rules that block traversal sequences in plugin query parameters
Monitor file integrity for the WordPress installation directory to identify unauthorized deletions

Monitoring Recommendations

Enable verbose access logging on WordPress sites and forward logs to a centralized SIEM for traversal-pattern queries
Alert on outbound responses from admin.php whose content type or size deviates from expected backup downloads
Track plugin inventory and flag any host still running backup-by-supsystic version 2.3.9

How to Mitigate CVE-2020-37246

Immediate Actions Required

Disable or remove the Supsystic Backup plugin until a patched version is confirmed installed
Restrict access to wp-admin/admin.php using IP allow-listing or HTTP authentication at the web server layer
Audit the WordPress filesystem for missing or modified files that may indicate prior exploitation
Rotate any credentials stored in wp-config.php if exposure is suspected

Patch Information

No vendor patch is referenced in the CVE record. Administrators should consult the Supsystic Official Website and the VulnCheck Advisory on Supsystic for vendor guidance, and replace the plugin with a maintained alternative if no fix is available. The latest plugin build can be reviewed from the WordPress Backup Plugin ZIP distribution.

Workarounds

Deploy WAF signatures that reject download parameters containing .. or absolute path prefixes
Enforce least-privilege file permissions so the web server user cannot read sensitive system files such as /etc/passwd
Move backup storage outside the web root and apply open_basedir restrictions in PHP configuration
Remove the plugin entirely if backup functionality is provided by another tool

bash

# Example WAF rule (ModSecurity) to block traversal in the download parameter
SecRule ARGS:download "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
  "id:1002020,phase:2,deny,status:403,log,\
  msg:'CVE-2020-37246 Supsystic Backup LFI traversal attempt'"