CVE-2023-7164: The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

high Affects backwpup (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2024-04-08; advisory modified 2026-06-17.

The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.

Package: backwpup (WordPress plugin) WordPress
Affected versions: <4.0.4
Fixed in: 4.0.4
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 2% (82.8th percentile)
Published: 2024-04-08
Source: nvd

References

NVD record backwpup (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2017-2551 high Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of same package: backwpup (WordPress plugin)
CVE-2023-5505 medium The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, same package: backwpup (WordPress plugin)
CVE-2023-5504 high The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, same package: backwpup (WordPress plugin)
CVE-2023-5775 low The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination same package: backwpup (WordPress plugin)
CVE-2023-6553 critical The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all ve also from 2023
CVE-2023-0315 high Froxlor vulnerable to Command Injection also from 2023