Arbitrary File Deletion Vulnerability in Backuply Plugin for WordPress
CVE-2025-10307
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 September 2025
What is CVE-2025-10307?
The Backuply plugin for WordPress allows for arbitrary file deletion due to insufficient file path validation in its delete backup functionality. This vulnerability affects all versions up to and including version 1.4.8. Authenticated attackers with Administrator access can exploit this flaw to delete crucial files on the server, potentially leading to remote code execution if critical files are targeted, such as the wp-config.php file. Website owners using this plugin should upgrade to the latest version to mitigate this risk.
Affected Version(s)
Backuply – Backup, Restore, Migrate and Clone * <= 1.4.8