CVE-2020-36848 Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download

What is CVE-2020-36848?

CVE-2020-36848 is a high-severity vulnerability in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid, published on 12 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.

Weakness: CWE-200

Which versions are affected by CVE-2020-36848?

It affects 1 product.

Products include Boldgrid Total Upkeep.

How do I fix CVE-2020-36848?

No fix has been published for CVE-2020-36848 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36848 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36848 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid

• CVE-2024-24869 WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerability High 7.5
• CVE-2025-2257 Command injection in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid High 7.2
• CVE-2024-9461 Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings High 7.2
• CVE-2024-13907 Server-side request forgery in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Medium 4.9
• CVE-2022-4932 Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2025-34084, GHSA-qcmh-3f59-hmv7.