CVE-2021-24155: Backup-Guard Backup Guard

High severity, CVSS 7.2. EPSS: 84.1% chance of exploitation in the next 30 days.

The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.

Affected products

• Backup-Guard Backup Guard: before 1.6.0 (fixed in 1.6.0)

Published 2021-04-05. Last modified 2026-06-17.