Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2015-1000006: recent-backups WordPress plugin allows attackers to download files
CVE-2015-1000006 · published 10 years ago
Summary
The recent-backups plugin version 0.7 for WordPress can be tricked into fetching any file from the server and sending it to an attacker. This could expose private data, configuration files, or other sensitive information. Update to a patched version or deactivate the plugin until a fix is released, and review logs for unexpected file access.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| recent-backups_project | recent-backups |
0.7 cpe:2.3:a:recent-backups_project:recent-backups:0.7:*:*:*:*:wordpress:*:* |
Original advisory text
Remote file download vulnerability in recent-backups v0.7 wordpress plugin
Remote file download vulnerability in recent-backups v0.7 wordpress plugin
References
- http://www.securityfocus.com/bid/97125
- http://www.vapidlabs.com/advisory.php?v=144 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published6 Oct 2016
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-1000006 · NVD
Track software like this
Free during beta