Local File Inclusion Vulnerability in Bei Fen WordPress Backup Plugin

CVE-2025-9993

What is CVE-2025-9993?

The Bei Fen – WordPress Backup Plugin is susceptible to Local File Inclusion (LFI), affecting all versions up to 1.4.2. This vulnerability allows authenticated attackers with Subscriber-level access or higher to include and execute arbitrary PHP files on the server by manipulating the 'task' parameter. Such an exploit can lead to unauthorized execution of PHP code, enabling the bypass of access controls, the extraction of sensitive data, and potential full code execution if malicious .php files are uploaded. It is important to note that this vulnerability impacts installations running PHP version 7.1 or older.

References