The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid accepts a user‑supplied compression_level value and passes it directly to PHP’s proc_open without validation, creating a command injection flaw identified as CWE‑78. An authenticated administrator can supply arbitrary shell commands through this parameter, enabling the attacker to execute code with the privileges of the web server process and potentially compromise the entire site.

All releases of the plugin through version 1.16.10 are affected. The vulnerability targets the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid, a WordPress plugin available on WordPress.org.

The CVSS base score of 7.2 indicates severe impact, while an EPSS score of 2 % suggests that exploitation is possible but not yet widespread. The flaw requires administrator privileges, so an attacker must obtain or compromise an admin account. Although the vulnerability is not yet listed in the CISA KEV catalog, its high potential impact makes it a priority for remediation.