WordPress sites that use the Backuply – Backup, Restore, Migrate and Clone plugin are vulnerable because the delete‑backup routine accepts any file path and does not validate it. An attacker who has Administrator-level access can delete any file that the server can reach, including critical configuration files such as wp-config.php. Removing or modifying these files can compromise the site and provide a foothold for further exploitation, effectively turning the vulnerability into a remote code execution vector. This weakness is classified as CWE‑22, Path Traversal.

All releases of the Backuply WordPress plugin up to and including version 1.4.8 are affected. The plugin is distributed by Softaculous and installed on WordPress sites that run with Administrator or higher privileges. No other product versions or forks are known to be impacted at the current time.

The CVSS score of 6.5 indicates a moderate severity, while an EPSS score of 2% suggests the likelihood of exploitation is low to moderate. The vulnerability is not listed in the CISA KEV catalog. An attacker requires administrative access to the WordPress instance and is able to delete arbitrary files, potentially leading to remote code execution if a critical file such as wp-config.php is removed. The risk is amplified in environments where user privileges are not tightly controlled or where server permissions allow deletion of core files.