CVE-2020-37246CWE-98

CVE-2020-37246

Medium · published May 16, 2026

CVSS v3.1

6.2

EPSS

Percentile

51.5

In the wild

Unconfirmed

What it is

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

The record

Technical detail

CVSS v3.1: 6.2 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00673 · 51.5th percentile
Weakness: CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published: 2026-05-16T20:16Z

References (4)

https://downloads.wordpress.org/plugin/backup-by-supsystic.zip · [email protected]https://supsystic.com/ · [email protected]https://www.exploit-db.com/exploits/49545 · [email protected]https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion · [email protected]

EPSS history

Timeline

16 MAY 15:26Z
WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion
cvelistv5