The BackWPup plugin for WordPress contains a critical path traversal vulnerability that permits authenticated attackers to access sensitive files or achieve remote code execution.

This vulnerability is a Local File Inclusion flaw (CWE-22) triggered by improper sanitization of path traversal sequences in the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint. It requires the attacker to have Administrator-level access or specific delegated permissions to interact with the backup functionality.

Successful exploitation of this vulnerability allows an attacker to read sensitive system files, such as wp-config.php, which contains database credentials and encryption keys. With a CVSS score of 7.2, the impact is considered High, as the flaw can lead to full server compromise and remote code execution, posing a significant risk to data confidentiality, integrity, and availability.

Immediate Action: Update the BackWPup plugin to the latest available version beyond 5.6.6 where the sanitization logic has been patched.

Proactive Monitoring: Monitor access logs for the /wp-json/backwpup/v1/getblock endpoint, specifically looking for suspicious patterns involving traversal sequences like "....//" or attempts to access non-standard file paths.

Compensating Controls: If an immediate update is not feasible, restrict access to the WordPress REST API for unauthorized users or disable the BackWPup plugin entirely until a patch can be applied.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing the BackWPup plugin must prioritize this update to prevent potential unauthorized access to sensitive configuration files. Given the severity of remote code execution, administrators should verify that only trusted users possess the capabilities required to interact with the backup REST endpoints.