CVE-2025-10307

MEDIUM

Backuply WordPress <1.4.8 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-10307. PoCs published by jFriedli.

AI-analyzed exploit summary This repository contains a functional JavaScript-based exploit for CVE-2025-10307, demonstrating arbitrary file deletion via path traversal in the Backuply WordPress plugin. The PoC extracts a nonce from the admin page and attempts to delete a file outside the intended directory using varying depths of path traversal.

Description

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Exploits (1)

nomisec WORKING POC
by jFriedli · poc
https://github.com/jFriedli/CVE-2025-10307

This repository contains a functional JavaScript-based exploit for CVE-2025-10307, demonstrating arbitrary file deletion via path traversal in the Backuply WordPress plugin. The PoC extracts a nonce from the admin page and attempts to delete a file outside the intended directory using varying depths of path traversal.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Backuply WordPress plugin
Auth required
Prerequisites: Authenticated admin access to WordPress · Backuply plugin installed and active
devstral-2 · analyzed Apr 28, 2026 Full analysis →

Scores

CVSS v3 6.5
EPSS 0.0061
EPSS Percentile 44.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
softaculous/Backuply – Backup, Restore, Migrate and Clone < 1.4.8
Published Sep 26, 2025
Tracked Since Feb 18, 2026