The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 26 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Boldgrid
Boldgrid total Upkeep
CPEs cpe:2.3:a:boldgrid:total_upkeep:*:*:*:*:*:wordpress:*:*
Vendors & Products Boldgrid
Boldgrid total Upkeep
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 26 Nov 2024 14:15:00 +0000

Type Values Removed Values Added
Description The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Title Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2024-11-26T14:41:18.738Z

Reserved: 2024-10-03T08:06:58.564Z

Link: CVE-2024-9461

cve-icon Vulnrichment

Updated: 2024-11-26T14:36:46.125Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-26T14:15:22.533

Modified: 2025-05-22T14:27:29.880

Link: CVE-2024-9461

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.