CVE-2021-47979CWE-22

WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion

High · published May 16, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00397 · 32.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-16T15:26Z
EPSS history
Timeline
  • 16 MAY 15:26Z
    WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion
    cvelistv5