Backuply Vulnerability– Backup, Restore, Migrate and Clone – Authenticated (Admin+) Directory Traversal – CVE-2024-2294 | WordPress Plugin Vulnerability Report

Plugin Name: Backuply – Backup, Restore, Migrate and Clone

Key Information:

  • Software Type: Plugin
  • Software Slug: backuply
  • Software Status: Active
  • Software Author: softaculous
  • Software Downloads: 2,266,088
  • Active Installs: 200,000
  • Last Updated: March 19, 2024
  • Patched Versions: 1.2.8
  • Affected Versions: <= 1.2.7

Vulnerability Details:

  • Name: Backuply – Backup, Restore, Migrate and Clone <= 1.2.7
  • Title: Authenticated (Admin+) Directory Traversal
  • Type: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
  • CVE: CVE-2024-2294
  • CVSS Score: 4.9
  • Publicly Published: March 15, 2024
  • Researcher: Dau Hoang Tai - VCI
  • Description: The Backuply plugin for WordPress contains a Directory Traversal vulnerability in versions up to and including 1.2.7. Through the 'backup_name' parameter in the 'backuply_download_backup' function, attackers with the 'activate_plugins' capability can access arbitrary files on the server, potentially exposing sensitive information. This vulnerability is specific to sites hosted on Windows servers.


Backuply, a plugin designed for WordPress to facilitate backups, restoration, migration, and cloning, harbors a vulnerability in versions up to and including 1.2.7 that permits Directory Traversal. This security flaw, identified as CVE-2024-2294, has been addressed in version 1.2.8.

Detailed Overview:

This vulnerability was uncovered by Dau Hoang Tai from VCI, spotlighting a critical oversight in the Backuply plugin where the 'backup_name' parameter within the 'backuply_download_backup' function was improperly sanitized. This lapse enables users with administrative privileges, specifically those with the ability to activate plugins, to traverse the server directories and access files they should not. While the impact is confined to sites on Windows servers, the potential exposure of sensitive data underscores the gravity of this vulnerability.

Advice for Users:

  • Immediate Action: Users of Backuply are strongly urged to update their plugin to version 1.2.8 promptly to mitigate this security risk.
  • Check for Signs of Vulnerability: Site administrators should review their server logs for any unusual activities or attempts to access files beyond the web root directory, which could indicate exploitation attempts.
  • Alternate Plugins: Although the vulnerability in Backuply has been patched, users may consider exploring other backup plugins as a precautionary measure to diversify their security profile.
  • Stay Updated: Maintaining the latest versions of all WordPress plugins is crucial for security. Regular updates not only bring new features but also patch vulnerabilities that could compromise your site.


The swift resolution of the Directory Traversal vulnerability in Backuply by its developers highlights the critical nature of proactive security measures in the WordPress ecosystem. Users are reminded of the importance of updating to version 1.2.8 or later to safeguard their installations against potential exploits stemming from this flaw.


Detailed Report: 

In the digital realm where your website serves as a cornerstone of your business, ensuring its security is paramount. The recent discovery of a vulnerability within the Backuply plugin, a trusted tool for data protection and recovery, underscores the ever-present need for vigilance in the online world. Identified as CVE-2024-2294, this flaw highlights the fragility of digital defenses and the constant need for upkeep. This case serves as a crucial lesson for small business owners: the security of your website is not just about protection but about maintaining the trust of your customers and the integrity of your digital presence.

Backuply Plugin: An Overview

Backuply has been a go-to solution for WordPress users, offering a suite of functionalities to backup, restore, migrate, and clone website data. With over 2 million downloads and 200,000 active installations, its role in the WordPress ecosystem is significant. Developed by Softaculous, Backuply was last updated on March 19, 2024, with a patch released in version 1.2.8 to address the recent security concerns.

The Vulnerability: CVE-2024-2294

CVE-2024-2294 is a Directory Traversal vulnerability found in versions of Backuply up to 1.2.7. This flaw allowed users with administrative privileges, specifically those with the 'activate_plugins' capability, to traverse the server directories and access files they should not. The vulnerability, which specifically impacted sites on Windows servers, posed a risk of exposing sensitive data. Discovered by Dau Hoang Tai from VCI, this issue was made public on March 15, 2024, bringing to light the need for immediate action.

Potential Risks and Impacts

The implications of such a vulnerability are far-reaching for small business owners. Unauthorized access to sensitive files could lead to data breaches, compromising both user and business data. The resultant damage to customer trust and business reputation can have long-lasting effects, potentially more devastating than the immediate security breach.

Remediation and Prevention

In response to CVE-2024-2294, Backuply's developers promptly issued a patch in version 1.2.8. Users of the plugin are urged to update immediately to safeguard their sites. Beyond this, it's crucial for website owners to regularly review their server logs for any signs of unauthorized access and consider the adoption of alternative backup solutions as a diversified security strategy.

Previous Vulnerabilities

This is not the first challenge faced by Backuply; two previous vulnerabilities have been reported since January 26, 2024. This history emphasizes the importance of ongoing monitoring and updates to ensure the security of your website's plugins.

The Importance of Vigilance

For small business owners, staying abreast of every security update or vulnerability might seem daunting. However, the digital landscape demands vigilance. Regular updates, a keen eye on security reports, and an understanding of your website's components are essential. Consider leveraging managed WordPress hosting services or cybersecurity tools that can alleviate some of the burdens, ensuring your site remains secure without constant manual oversight.

In conclusion, the discovery of CVE-2024-2294 within the Backuply plugin serves as a stark reminder of the dynamic nature of cybersecurity. For small business owners, this incident underscores the critical importance of regular maintenance and updates for all website components. In the digital age, your proactive stance on security not only protects your data but also preserves the trust and reliability your customers place in your online presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Backuply Vulnerability– Backup, Restore, Migrate and Clone – Authenticated (Admin+) Directory Traversal – CVE-2024-2294 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment