The Worry Proof Backup plugin for WordPress, versions up to 0.2.4, permits path traversal via the backup upload interface. An attacker who is authenticated with Subscriber or higher privileges can craft a ZIP archive containing directory traversal characters; when the plugin extracts the archive, it writes the files to arbitrary locations on the server. If a PHP file is uploaded, the attacker could execute it, resulting in remote code execution. The weakness corresponds to unvalidated file paths (CWE‑22).

Affected systems include all installations of the BearThemes "Worry Proof Backup" WordPress plugin from the earliest release through version 0.2.4. Any instance that has the backup upload feature enabled and is accessible to Subscriber‑level or higher accounts is vulnerable. No later versions are affected.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is below 1 %, showing that the probability of exploitation is low at present, and it is not listed in the CISA KEV catalog. Attackers must first authenticate with a valid account that has Subscriber‑level or higher privileges, then upload a malicious ZIP to trigger the traversal. Once executed, the attacker could gain full control over the web server.