CVE-2024-0697 in Backuply Plugin
Summary
by MITRE • 01/27/2024
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the node_id parameter in the backuply_get_jstree function. This makes it possible for attackers with administrator privileges or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2024-0697 affects the Backuply plugin for WordPress, specifically targeting versions up to and including 1.2.3. This directory traversal flaw exists within the backuply_get_jstree function and exploits the node_id parameter to gain unauthorized access to arbitrary files on the affected server. The vulnerability is particularly concerning because it requires only administrator-level privileges or higher to exploit, making it accessible to attackers who have already compromised administrative accounts or those who can escalate privileges within the WordPress environment. The impact extends beyond simple file access, as the compromised files may contain sensitive information such as database credentials, configuration settings, user data, and other confidential resources that could be leveraged for further attacks.
The technical exploitation of this vulnerability stems from improper input validation within the node_id parameter handling. When an attacker submits a malicious node_id value containing directory traversal sequences such as ../ or ..\, the backuply_get_jstree function fails to adequately sanitize or validate the input before processing. This allows the function to traverse the file system and access files outside of its intended scope, potentially exposing critical system files, WordPress core files, plugin files, theme files, and configuration data. The vulnerability aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as directory traversal or path traversal attacks. These attacks exploit insufficient security controls in applications that process file system requests without proper validation of user-supplied input.
From an operational perspective, this vulnerability creates significant risk for WordPress installations using the affected Backuply plugin. Attackers who successfully exploit this vulnerability can extract sensitive information from the server, potentially leading to complete system compromise. The exposure of configuration files may reveal database connection details, encryption keys, and other critical system information that could enable attackers to move laterally within the network or escalate privileges further. The impact is amplified by the fact that administrators often have elevated privileges and may be granted access to the plugin's backup functionality, making this attack vector particularly dangerous for organizations relying on WordPress for their web presence. The vulnerability also affects the principle of least privilege, as it allows for unauthorized file access that should be restricted to legitimate system operations.
Organizations should implement immediate mitigations to address this vulnerability, starting with updating the Backuply plugin to the latest version where the directory traversal issue has been resolved. Security teams should conduct thorough audits of all WordPress installations to identify systems running vulnerable plugin versions and ensure prompt remediation. Network segmentation and access controls should be reviewed to limit administrative privileges and reduce the potential impact of such vulnerabilities. Additionally, implementing proper input validation and output encoding practices can help prevent similar issues in other applications. The ATT&CK framework categorizes this type of vulnerability under T1059 Command and Scripting Interpreter and T1083 File and Directory Discovery, indicating that attackers may use such vulnerabilities to gather system information and establish persistence. Regular security monitoring and vulnerability scanning should be implemented to detect and remediate similar issues before they can be exploited by malicious actors.