Backuply WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Backuply – Backup, Restore, Migrate and Clone plugin for WordPress, affecting all versions through 1.4.8. This issue arises from inadequate validation of file paths in the backup deletion feature. As a result, authenticated attackers with Administrator-level access can delete arbitrary files on the server. Deleting certain files, such as wp-config.php, could lead to remote code execution.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, with the potential for remote code execution if a critical file is removed.

Reproduction

To reproduce this vulnerability, an authenticated user with Administrator-level access can use the plugin's backup deletion feature. The vulnerability can be exploited by sending a request to delete a backup file while bypassing the file path validation, allowing for the deletion of arbitrary files on the server.

Remediation

Users are advised to update the Backuply WordPress plugin to version 1.4.9 or later.