CVE-2015-10134
BaseFortify
Publication date: 2025-07-19
Last updated on: 2025-07-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | simple_backup | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Simple Backup plugin for WordPress has a vulnerability in versions up to 2.7.10 that allows attackers to download arbitrary files from the affected site. This happens because the download_backup_file function does not properly check user capabilities or validate file types, enabling attackers to access sensitive files like wp-config.php.
How can this vulnerability impact me? :
This vulnerability can allow attackers to download sensitive files from your WordPress site, such as configuration files that may contain database credentials and other critical information. This can lead to unauthorized access, data exposure, and potential compromise of your website.