Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-10307. PoCs published by jFriedli.
AI-analyzed exploit summary This repository contains a functional JavaScript-based exploit for CVE-2025-10307, demonstrating arbitrary file deletion via path traversal in the Backuply WordPress plugin. The PoC extracts a nonce from the admin page and attempts to delete a file outside the intended directory using varying depths of path traversal.
Description
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Exploits (1)
This repository contains a functional JavaScript-based exploit for CVE-2025-10307, demonstrating arbitrary file deletion via path traversal in the Backuply WordPress plugin. The PoC extracts a nonce from the admin page and attempts to delete a file outside the intended directory using varying depths of path traversal.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H