CVE-2024-24869 WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerability
Attackers can exploit path traversal in the Total Upkeep plugin to download arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-24869?
CVE-2024-24869 is a high-severity path traversal vulnerability in BoldGrid Total Upkeep, published on 17 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep allows Relative Path Traversal.This issue affects Total Upkeep: from n/a through 1.15.8.
Weakness: CWE-22
Which versions are affected by CVE-2024-24869?
It affects 1 product.
Products include Boldgrid Total Upkeep.
How do I fix CVE-2024-24869?
No fix has been published for CVE-2024-24869 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-24869 being exploited?
There is no known exploitation of CVE-2024-24869 in the wild and no public exploit code.
Other vulnerabilities in BoldGrid Total Upkeep
- CVE-2020-36848 Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download
- CVE-2025-2257 Command injection in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- CVE-2024-9461 Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
- CVE-2024-13907 Server-side request forgery in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- CVE-2022-4932 Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure
Sources
Also known as GHSA-82rx-89fp-4w49.