The Worry Proof Backup plugin for WordPress contains a critical path traversal vulnerability that enables authenticated attackers to execute arbitrary code on the host server.

This vulnerability occurs in the backup upload functionality, specifically within the upload-backup.php script. Authenticated attackers with Subscriber-level access or higher can bypass directory restrictions to write malicious files, including PHP scripts, to the server.

The ability to achieve remote code execution poses a severe risk to organizational security, potentially leading to full system compromise, data exfiltration, and lateral movement within the network. With a CVSS score of 8.8, this vulnerability is classified as High severity. Successful exploitation could result in total loss of control over the affected WordPress instance and the underlying hosting environment.

Immediate Action: Since a specific patch version is not currently identified, users should immediately deactivate and remove the Worry Proof Backup plugin until the vendor releases a secure update.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests targeting the inc/libs/upload-backup.php endpoint and inspect the site directory for unexpected file uploads.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block directory traversal patterns and restrict access to plugin upload endpoints to authorized administrative roles only.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Given the capability for remote code execution and the availability of public proof-of-concept code, this vulnerability presents an urgent risk. Administrators are strongly advised to remove the vulnerable plugin from their environments immediately, as no confirmed remediation path currently exists. Monitoring for signs of unauthorized file creation is essential until the software is either patched or permanently decommissioned.