Description

Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-06T15:17:23.793Z",
  "pubdate": "2026-08-06T15:17:23.793Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in Total Upkeep versions 1.17.2 and below. This security flaw allows unauthenticated remote attackers to bypass authorization checks and perform restricted administrative actions or access sensitive functionalities associated with the backup and maintenance plugin. The presence of this vulnerability introduces significant risk to the integrity, confidentiality, and availability of affected WordPress installations. An attacker with network access can exploit this flaw without possessing any prior credentials or high-level privileges. The primary implication of successful exploitation is the potential unauthorized manipulation of site data and system configurations, potentially leading to full site compromise or data leakage depending on the extent of the exposed functionality within the vulnerable component.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient or missing authorization checks within the access control logic of the Total Upkeep plugin for versions 1.17.2 and below. Specifically, sensitive endpoints or AJAX handlers fail to validate whether the incoming request originates from an authenticated user with administrative privileges, or they improperly validate user roles before executing requested operations.\nThe vulnerable component involves the request handling functions responsible for administrative actions within the plugin. Because network exposure is inherent to web applications, any remote unauthenticated attacker can directly interact with these exposed endpoints via HTTP requests.\nThe exploitation method involves crafting specialized HTTP requests directed at the unprotected functions or endpoints implemented by the plugin. The attack flow proceeds as follows: First, the attacker identifies the target URL corresponding to the plugin's action handlers. Second, the attacker formulates a payload containing the parameters required to trigger the desired administrative or data-access function. Third, the attacker transmits the HTTP request to the target server without including valid session cookies or authentication tokens. Because the application fails to enforce proper access control checks and omits authentication verification, the backend code processes the request as if it were issued by an authorized administrator. Consequently, the application executes the requested operations, granting the attacker unauthorized access to sensitive plugin features or data manipulation capabilities.\nThe post-exploitation impact includes unauthorized state changes, potential execution of administrative routines, and exposure of sensitive operational data managed by the backup solution."
}