CVE-2017-2551: Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.

high Affects backwpup (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2017-09-28; advisory modified 2026-06-17.

Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.

Package: backwpup (WordPress plugin) WordPress
Affected versions: <=3.4.1
Fixed in: no fix recorded
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 2% (76.7th percentile)
Published: 2017-09-28
Source: nvd

References

CWE-552

NVD record backwpup (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2023-7164 high The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its tempo same package: backwpup (WordPress plugin)
CVE-2023-5505 medium The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, same package: backwpup (WordPress plugin)
CVE-2023-5504 high The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, same package: backwpup (WordPress plugin)
CVE-2023-5775 low The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination same package: backwpup (WordPress plugin)
CVE-2021-39316 high The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive co same weakness: CWE-552
CVE-2023-6114 high The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5 same weakness: CWE-552