The BackUpWordPress plugin versions prior to 3.15 fails to verify user capabilities or a nonce when executing an AJAX action that purges its backup directory. This oversight allows any authenticated user with at least Subscriber privileges to trigger file deletions, removing backup protection files and the underlying backups themselves. The result is loss of stored backup data and potential exposure of sensitive content, as well as interruption of ongoing backup processes.

WordPress plugin BackUpWordPress, versions earlier than 3.15. The vulnerability affects all installations running any version before 3.15, regardless of configuration.

Authentication is required, but no higher privileges are needed; any logged‑in user with the Subscriber role can exploit the issue by sending the insecure AJAX request. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating its current exploitation likelihood is unknown. The risk profile is moderate due to the reliance on user authentication; however, once exploited the impact can be significant, leading to the deletion of backup files and potential exposure of backup content.