CVE-2026-16253

Deferred Deferred - Pending Action

Unauthenticated Backup Access in Total Upkeep WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-16253

EUVD

EUVD-2026-57087

Affected Vendors & Products

Vendor	Product	Version / Range
boldgrid	total_upkeep	to 1.17.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The Total Upkeep WordPress plugin before version 1.17.3 has a flaw where the secret key used for backup-restore functionality is exposed to unauthenticated users. This allows attackers to access sensitive backup data and force a full site restore, overwriting the live site's files and database.

Detection Guidance

Check the installed version of the Total Upkeep plugin. If it is below 1.17.3, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

Attackers can steal sensitive backup information and completely overwrite your website's files and database, causing data loss and potential site downtime. This could lead to unauthorized access, defacement, or loss of critical data.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Total Upkeep plugin to version 1.17.3 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Hi! I’m here to help you understand CVE-2026-16253. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70