Server-Side Request Forgery in Total Upkeep Plugin by BoldGrid for WordPress
CVE-2024-13907
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 February 2025
What is CVE-2024-13907?
The Total Upkeep – WordPress Backup Plugin, developed by BoldGrid, is susceptible to Server-Side Request Forgery in all versions through 1.16.8. This vulnerability allows authenticated users with Administrator-level access to exploit the 'download' function, enabling them to send web requests to arbitrary destinations. This could potentially allow attackers to access and manipulate information from internal services, leading to unauthorized actions.
Affected Version(s)
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid * <= 1.16.8