The miniOrange Backup and Restore plugin for WordPress is vulnerable to path traversal, which could allow an authenticated attacker to compromise system integrity.

This vulnerability is a path traversal flaw (CWE-22) residing in the plugin's backup/restore functionality. Based on the CVSS vector (PR:L), this attack requires the attacker to have low-level authenticated access to the WordPress dashboard to exploit the flaw.

Successful exploitation allows an attacker to manipulate files on the server, potentially leading to unauthorized data deletion or system instability. With a CVSS score of 8.8, this is a high-severity issue that poses a significant risk to the availability and integrity of the WordPress environment.

Immediate Action: Verify if the plugin is in use and monitor for vendor updates; if no patch is available, deactivate and remove the plugin immediately to eliminate the attack surface.

Proactive Monitoring: Review WordPress administrative logs for unusual file system activity or unauthorized access to the plugin's configuration pages.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block path traversal patterns in incoming HTTP requests.

Public Exploit Available: Yes — an entry exists on ExploitDB (50503).

Given the high severity and the availability of a public exploit, administrators must prioritize the removal or containment of this plugin. If the functionality is not strictly required, decommissioning the plugin is the most effective way to remediate this risk immediately.