The Bei Fen – WordPress Backup Plugin is vulnerable to a Local File Inclusion (LFI) attack through the "task" parameter in all versions up to 1.4.2. Authenticated users with Subscriber level or higher can requested arbitrary .php files to be included and executed on the server, allowing the attacker to run arbitrary PHP code. This flaw can be used to bypass access controls, steal sensitive information, or compromise the entire site. The vulnerability is classified as CWE‑98 and only affects WordPress installations running PHP 7.1 or older.

Affected systems are WordPress sites that have the Bei Fen – WordPress Backup Plugin version 1.4.2 or earlier installed. The publisher is d3rd4v1d. The issue is relevant for servers running PHP 7.1 or older, as newer PHP versions are not impacted by this flaw.

The severity of this vulnerability is high, with a CVSS score of 8.1, while the EPSS score is below 1%, indicating a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. The attack vector requires that the attacker is an authenticated user with at least Subscriber‑level access and that a .php file is available for inclusion, either through upload or by other means. With those conditions, the attacker can execute arbitrary PHP code, potentially taking full control of the affected server.