Description

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T06:18:55.103Z",
  "pubdate": "2026-08-12T06:18:55.103Z",
  "executiveSummary": "An authentication bypass vulnerability exists within the Total Upkeep WordPress plugin before version 1.17.3, specifically affecting its backup-restore functionality. The flaw stems from inadequate protection of the secret token responsible for authorizing backup and restore operations, which inadvertently exposes the sensitive token to unauthenticated remote users.\nThe impact of this vulnerability is critical. An unauthenticated attacker can leverage this exposure to disclose sensitive system backup information and subsequently force an unauthorized full site restore. This malicious action overwrites the live site's critical files and database, leading to potential data destruction, complete loss of site integrity, and denial of service.\nThe affected product is the Total Upkeep WordPress plugin for versions prior to 1.17.3. Risk implications are severe due to the remote, unauthenticated nature of the attack vector, requiring zero prior privileges or user interaction.\nAttacker capabilities include arbitrary backup data disclosure and remote code execution or site destruction via forced state reversion. Exploitation requirements are minimal, primarily consisting of network access to the target WordPress installation and the ability to capture or deduce the inadequately protected backup-restore authorization secret.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper access control and secret management mechanisms utilized by the Total Upkeep WordPress plugin before version 1.17.3. The component responsible for handling backup-restore functionality fails to properly validate the authenticity and authorization context of incoming requests.\nSpecifically, the secret token designed to authorize administrative backup and restore procedures is leaked or insufficiently guarded against external exposure. Unauthenticated network exposure allows external actors to query or extract this secret parameter directly via HTTP requests.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker interacts with the target WordPress site to harvest or deduce the exposed backup-restore authorization secret. Second, utilizing this unauthorized access to the secret parameter, the attacker crafts a malicious HTTP request directed at the plugin's backup-restore endpoint.\nThird, the vulnerable component processes the request, incorrectly accepting the compromised secret as valid without enforcing session verification or administrative privilege checks. Finally, the payload behavior executes the restore routine, forcing the application to read designated backup archives and overwrite critical system assets, including the live site files and underlying database.\nThe affected component is the backup-restore subsystem of the Total Upkeep plugin across versions prior to 1.17.3. Authentication requirements are nonexistent for the initial reconnaissance and request phase, as the flaw bypasses standard privilege checks. Network exposure is external over HTTP/HTTPS, enabling remote exploitation over the internet."
}