CVE-2022-4932 in Total Upkeep Plugin
Summary
by MITRE • 03/07/2023
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2022-4932 affects the Total Upkeep plugin for WordPress, a widely used tool for managing website maintenance tasks including automated backups. This information disclosure flaw exists in plugin versions up to and including 1.14.13, representing a significant security risk for WordPress installations that utilize this particular plugin. The vulnerability stems from inadequate access controls within the plugin's implementation, specifically targeting the heartbeat_received() function that operates within WordPress's heartbeat mechanism designed for real-time communication between the browser and server.
The technical flaw manifests through the absence of proper authorization checks within the heartbeat_received() function, which is part of WordPress's core heartbeat API. This API typically handles background communication tasks and status updates for WordPress administrators. However, in this vulnerable implementation, the function fails to verify user permissions before exposing sensitive backup path information. The vulnerability is particularly concerning because it requires only subscriber-level permissions or higher to exploit, meaning that any authenticated user with minimal privileges can access this functionality. This represents a clear violation of the principle of least privilege and demonstrates a critical design flaw in the plugin's access control mechanisms.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with actionable intelligence that can lead to more severe consequences. When an authenticated attacker with subscriber permissions accesses the heartbeat_received() function, they can retrieve backup file paths that are typically protected from unauthorized access. These paths can then be used to directly download backup files from the server, potentially exposing sensitive website data including user credentials, database contents, and proprietary information. The vulnerability effectively undermines the security model of WordPress installations by allowing low-privilege users to bypass normal access controls and gain access to backup files that should only be available to administrators or system-level users.
This vulnerability aligns with CWE-284, which addresses improper access control issues, and represents a specific instance of insufficient authorization checks within WordPress plugin architecture. From an ATT&CK framework perspective, this vulnerability maps to T1213.002 - Data from Information Repositories, specifically targeting backup data that should remain protected within the system. The attack vector leverages the WordPress heartbeat API, which is commonly used by legitimate administrative tools and is often not subject to strict monitoring or filtering, making this attack particularly stealthy and difficult to detect. The vulnerability also demonstrates poor security practices in plugin development, where developers fail to properly implement authorization checks even for functions that are part of core WordPress infrastructure.
The recommended mitigations for this vulnerability include immediate updating of the Total Upkeep plugin to version 1.14.14 or later, which contains the necessary authorization fixes. System administrators should also implement additional monitoring for heartbeat API usage patterns and establish network-level controls to restrict access to backup files even when paths are exposed. Organizations should conduct comprehensive security assessments of all installed WordPress plugins to identify similar authorization flaws, particularly in functions that interface with core WordPress APIs. Regular security audits of plugin code should include thorough reviews of access control mechanisms, especially for functions that respond to heartbeat events or other background communication protocols. Additionally, implementing role-based access controls and regularly reviewing user permissions can help limit the impact of such vulnerabilities even when they are present in the system.