Arbitrary File Deletion Vulnerability in CYAN Backup Plugin for WordPress

CVE-2025-12092

What is CVE-2025-12092?

The CYAN Backup plugin for WordPress is affected by an arbitrary file deletion vulnerability due to inadequate file path validation in the delete functionality. This issue allows authenticated attackers with Administrator-level access to delete any file on the server, increasing the risk of remote code execution if critical files, like wp-config.php, are removed. It is crucial for site administrators to update to the latest version or apply the necessary patches to safeguard their sites against potential exploitation.

References