CVE-2024-2294 in Backuply Plugin
Summary
by MITRE • 03/16/2024
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/13/2026
The vulnerability identified as CVE-2024-2294 affects the Backuply WordPress plugin, specifically targeting versions up to and including 1.2.7. This directory traversal flaw exists within the backuply_download_backup function and exploits the backup_name parameter to allow unauthorized file access. The security issue is particularly concerning because it enables attackers with minimal privileges to access sensitive server files, potentially compromising the entire WordPress installation and underlying system data. The vulnerability's impact is further amplified by the fact that it requires only the activate_plugins capability, which is often granted to less privileged users in WordPress environments. This makes the attack vector more accessible and increases the potential for exploitation in various attack scenarios.
The technical exploitation of this vulnerability occurs through a directory traversal attack that manipulates the backup_name parameter to navigate through the file system hierarchy. When an attacker crafts a malicious request with a specially formatted backup_name value, the plugin fails to properly validate or sanitize the input before processing it. This lack of input validation creates a path traversal condition that allows access to files outside of the intended backup directory. The vulnerability specifically impacts Windows server environments, which suggests that the implementation may not properly handle path separators or file system access controls on windows platforms. This Windows-specific limitation indicates that the plugin's file access logic may not adequately address the different path resolution mechanisms used in windows versus unix-like systems.
The operational impact of this vulnerability extends beyond simple information disclosure, as the compromised files may contain database credentials, configuration settings, user information, or other sensitive data that could be leveraged for further attacks. Attackers could potentially access wp-config.php files containing database passwords, plugin configuration files with authentication details, or other system files that provide insights into the server architecture. The ability to access arbitrary files through a plugin with activate_plugins capability creates a significant risk for WordPress installations where this privilege is granted to users who should not have such extensive access. This vulnerability essentially allows attackers to bypass normal file system access controls and directly access server resources that should remain protected.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the latest version of the Backuply plugin where the directory traversal issue has been patched. The patch should include proper input validation and sanitization of the backup_name parameter to prevent path traversal attacks. Additionally, administrators should review user capabilities and ensure that the activate_plugins permission is only granted to trusted users with legitimate administrative needs. Implementing web application firewalls with rules to detect and block directory traversal patterns can provide additional protection layers. Regular security audits of installed plugins and themes should include checks for similar vulnerabilities, particularly those involving file system access functions. This vulnerability aligns with CWE-22 Directory Traversal and can be mapped to ATT&CK technique T1078 Valid Accounts, as it allows attackers to escalate privileges through minimal account capabilities to access sensitive system files. The remediation process should also include monitoring for suspicious backup download requests and implementing proper access controls to limit file system access for plugin functions.