CVE-2024-2294: Softaculous Backuply – Backup, Restore, Migrate And Clone

Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days.

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers.

Affected products

• Softaculous Backuply – Backup, Restore, Migrate And Clone: up to and including 1.2.7

Published 2024-03-16. Last modified 2026-06-17.