CVE-2020-36848 PUBLISHED

Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download

Assigner: Wordfence
Reserved: 11.07.2025 Published: 12.07.2025 Updated: 14.07.2025

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Product Status

Vendor boldgrid
Product Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Versions Default: unaffected
  • affected from * to 1.14.9 (incl.)

Credits

  • Wadeek finder

References

Problem Types

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE