CVE-2025-10307: Backuply WordPress Plugin Path Traversal

CVE-2025-10307 Overview

CVE-2025-10307 affects the Backuply – Backup, Restore, Migrate and Clone plugin for WordPress. The vulnerability allows authenticated attackers with Administrator-level access or above to delete arbitrary files on the server. The flaw exists in the delete backup functionality due to insufficient file path validation. Deleting critical files such as wp-config.php can lead to remote code execution, since WordPress enters a setup state when its configuration is missing. The vulnerability is classified as a path traversal issue [CWE-22] and affects all plugin versions up to and including 1.4.8.

Critical Impact
Authenticated administrators can delete arbitrary files on the underlying server, enabling remote code execution paths through configuration file removal.

Affected Products

Backuply – Backup, Restore, Migrate and Clone plugin for WordPress
All versions up to and including 1.4.8
WordPress installations using the vulnerable plugin

Discovery Timeline

2025-09-26 - CVE-2025-10307 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10307

Vulnerability Analysis

The Backuply plugin exposes a delete backup function that accepts a file path parameter without adequately validating or sanitizing the input. An authenticated user with Administrator privileges can supply a crafted path that traverses outside the intended backup directory. The plugin then removes the referenced file from disk.

Because WordPress rebuilds its installation flow when wp-config.php is absent, attackers can chain the deletion into a takeover. After removing the configuration file, an attacker can re-run the WordPress setup wizard and connect the site to a database they control, effectively achieving remote code execution through PHP payloads served by the reconfigured instance.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The delete backup handler does not enforce that the target file resides within the plugin's backup storage location. Path traversal sequences and absolute paths are accepted, allowing file operations anywhere the PHP process has write permissions.

Attack Vector

Exploitation requires an authenticated session at Administrator level or higher. The attacker issues a request to the plugin's delete backup endpoint with a manipulated file path parameter targeting a file outside the backup directory. See the Wordfence Vulnerability Report for endpoint-level technical detail and the WordPress Changeset Update for the corrective code changes.

// Verified exploit code is not published in the referenced advisories.
// Refer to the Wordfence advisory and WordPress plugin changeset for technical detail.

Detection Methods for CVE-2025-10307

Indicators of Compromise

Missing wp-config.php file or an unexpected WordPress setup screen when accessing the site root
Unexpected deletion of PHP files, .htaccess, or theme and plugin files from the webroot
Access log entries showing authenticated administrator requests to the Backuply delete backup endpoint with path traversal sequences such as ../
Sudden site outages or database connection errors following administrator activity in the Backuply plugin

Detection Strategies

Inventory WordPress installations and identify sites running Backuply at version 1.4.8 or earlier
Correlate web server access logs with file system deletion events on the WordPress document root
Alert on file integrity monitoring events targeting wp-config.php and other core WordPress files
Review WordPress audit logs for unusual administrator-initiated backup deletion activity

Monitoring Recommendations

Enable file integrity monitoring across WordPress webroots to catch unauthorized file removal
Forward web server and WordPress application logs to a centralized analytics platform for correlation
Track administrator account authentication events and flag sessions originating from unfamiliar IP addresses
Monitor for HTTP requests containing path traversal patterns targeting plugin admin endpoints

How to Mitigate CVE-2025-10307

Immediate Actions Required

Update the Backuply plugin to a version later than 1.4.8 as soon as the patched release is available
Audit WordPress administrator accounts and remove any that are unused, stale, or unnecessarily privileged
Enforce strong authentication and multi-factor authentication for all administrator accounts
Back up wp-config.php and other critical files to an off-server location so recovery is possible after file deletion

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Changeset Update for the exact code changes and confirm the fixed version through the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the Backuply plugin until the site can be updated to a patched version
Restrict administrator access to trusted network ranges using a web application firewall or reverse proxy
Apply WAF rules that block path traversal patterns in requests to WordPress admin-ajax and plugin endpoints
Set restrictive file system permissions so the PHP process cannot delete files outside required directories

bash

# Restrict write permissions on critical WordPress files
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php