The Total Upkeep plugin for WordPress suffers from a missing capability check on the 'wp_ajax_cli_cancel' function, allowing unauthenticated users to cancel a pending rollback. This flaw permits attackers to prevent a WordPress installation from automatically reverting a failed update, potentially leaving the site in a broken or insecure state. The weakness is a failure of authorization (CWE-862) that results in unauthorized data modification.

All installations of the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid with versions up to and including 1.17.1 are affected. No further version filtering is provided beyond this cutoff.

The CVSS score of 5.3 indicates medium severity, while EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, making the exact exploitation likelihood uncertain. The most likely attack vector is via the public WordPress AJAX endpoint 'wp_ajax_cli_cancel', accessible from the network without authentication. Because the flaw only allows cancellation of a rollback path, the impact is limited to failure to revert a failed update, which may cause downtime or site corruption, but does not grant broader access or control over the site.