A critical vulnerability in the Total Upkeep WordPress plugin allows unauthenticated attackers to compromise sensitive site data and perform unauthorized system restores.

This flaw involves improper information exposure (CWE-200) where the plugin fails to perform necessary capability checks on its backup-restore functionality. An unauthenticated attacker can exploit this to access sensitive backup files or trigger a destructive site restoration process.

The ability for an unauthenticated user to trigger a site restoration poses a severe risk to business continuity and data integrity. Successful exploitation could lead to the total loss of live site data, unauthorized access to sensitive backup archives, and significant reputational damage. While the CVSS score is 7.5, the potential for a full site overwrite elevates the operational urgency for all administrators.

Immediate Action: Update the Total Upkeep plugin to version 1.17.3 or later immediately to resolve the authorization flaw.

Proactive Monitoring: Review web server access logs for unusual requests directed at backup-related endpoints or unexpected POST requests to the plugin configuration paths.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin directory and specific backup-restore endpoints until patching is complete.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the high impact of a forced site restoration and the existence of a proof-of-concept, this vulnerability should be prioritized for immediate remediation. Administrators must verify that their instances are updated to version 1.17.3 and audit their backup configurations to ensure no unauthorized restoration activity has occurred.