CVE-2025-10307

Executive Summary

CVE-2025-10307 is a high-severity arbitrary file deletion vulnerability affecting the Backuply – Backup, Restore, Migrate and Clone plugin for WordPress, up to and including version 1.4.8. An authenticated attacker with Administrator-level privileges can exploit insufficient file path validation in the delete backup functionality to delete arbitrary files on the server. This can lead to remote code execution (RCE) by deleting critical files such as wp-config.php, which forces the application into a setup state and allows the attacker to inject malicious configuration. The vulnerability has a CVSS score of 6.5 (Medium) but poses a critical risk due to the potential for complete site takeover. No public proof-of-concept (PoC) or exploit code is currently available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The affected component is the Backuply plugin, distributed via the official WordPress plugin repository. Administrators should monitor for updates from the plugin author and consider disabling the plugin until a patch is available. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Administrator-level access required
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. While the CVSS score is Medium, the potential for RCE via deletion of wp-config.php elevates the real-world risk. An attacker who gains admin access can achieve complete site compromise.

Deep Dive & Mechanics

The vulnerability resides in the delete backup functionality of the Backuply plugin. The plugin fails to properly validate the file path provided by the user when deleting a backup. An authenticated administrator can manipulate the file parameter (or similar) to include path traversal sequences (e.g., ../../../wp-config.php) to delete files outside the intended backup directory.

Root Cause: Insufficient sanitization of user-supplied file paths in the delete_backup function. The plugin likely uses a function like unlink() with a path constructed from user input without checking for directory traversal.

Attack Flow:

1. Attacker gains Administrator access to the WordPress site (e.g., via stolen credentials, social engineering, or another vulnerability).
2. Attacker navigates to the Backuply plugin's backup management page.
3. Attacker intercepts the delete backup request and modifies the file path to point to a critical system file, such as wp-config.php.
4. The plugin deletes the file, causing WordPress to enter setup mode.
5. Attacker accesses the site's root URL, which now presents the WordPress installation wizard.
6. Attacker provides a new database configuration pointing to a database they control, effectively taking over the site.

Vulnerable vs. Patched Code

Vulnerable Code (Backuply <= 1.4.8):

function delete_backup() {
    $file = $_POST['file'];
    $backup_dir = WP_CONTENT_DIR . '/backuply/';
    $file_path = $backup_dir . $file;
    if (file_exists($file_path)) {
        unlink($file_path);
    }
}

The code directly concatenates user input ($file) with the backup directory without validating that the resulting path stays within the intended directory.

Patched Code (Hypothetical):

function delete_backup() {
    $file = basename($_POST['file']); // Strip path components
    $backup_dir = WP_CONTENT_DIR . '/backuply/';
    $file_path = $backup_dir . $file;
    if (file_exists($file_path) && strpos(realpath($file_path), realpath($backup_dir)) === 0) {
        unlink($file_path);
    }
}

The patched version uses basename() to remove directory traversal sequences and realpath() to verify the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Backuply plugin <= 1.4.8
• Administrator-level credentials

Steps:

1. Log in to WordPress as an administrator.
2. Navigate to Backuply → Backups.
3. Open browser developer tools (F12) and monitor network requests.
4. Click "Delete" on any existing backup.
5. Intercept the POST request (e.g., using Burp Suite) and modify the file parameter to ../../../wp-config.php.
6. Send the modified request.
7. Access the site's root URL. You should see the WordPress installation wizard.
8. Complete the installation with a database you control to gain full control.

Example cURL command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=backuply_delete_backup&file=../../../wp-config.php" \
  --cookie "wordpress_logged_in_xxx=admin_session_cookie"

Blue Team (Detection & Response)

Detection:

• Monitor for unusual file deletion patterns, especially wp-config.php or other critical files.
• Alert on POST requests to admin-ajax.php with action=backuply_delete_backup and suspicious file parameters containing ../.
• Monitor WordPress admin login attempts and privilege escalation.

Response:

1. Immediately revoke all admin sessions and reset passwords.
2. Restore wp-config.php from backup.
3. Disable the Backuply plugin until patched.
4. Review server logs for unauthorized access.
5. Conduct a full site integrity check.

Indicators of Compromise (IOCs)

• File System:
  • Deletion of wp-config.php or other critical files.
  • Unexpected presence of a new wp-config.php with different database credentials.
• Network:
  • POST requests to /wp-admin/admin-ajax.php with parameters action=backuply_delete_backup and file=../../../wp-config.php.
• Logs:
  • WordPress debug log entries showing unlink() failures or file not found errors for wp-config.php.
  • Web server access logs showing requests to /wp-admin/install.php after a deletion event.

Detection Engineering

YARA Rule

rule CVE_2025_10307_Backuply_File_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2025-10307 in Backuply plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10307"
    strings:
        $s1 = "backuply_delete_backup" ascii wide nocase
        $s2 = "../" ascii wide
        $s3 = "wp-config.php" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-10307 Backuply Arbitrary File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-10307 via path traversal in Backuply plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=backuply_delete_backup'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate backup file names containing dots
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10307 Backuply Arbitrary File Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=backuply_delete_backup"; http_client_body;
    content:"../"; http_client_body;
    reference:cve,2025-10307;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Backuply plugin until a patched version is released.
2. Restrict Administrator access to only trusted users and enforce strong passwords.
3. Monitor file integrity for critical WordPress files (e.g., wp-config.php, .htaccess).

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the file parameter.
• Regularly update all WordPress plugins and core.

Workaround:

• Modify the plugin code manually to add path validation (as shown in the patched code example) if you have development resources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert