SEC.co
Emergency
HIGH 7.5

CVE-2016-20076: WordPress Simple-Backup 2.7.11 Unauthenticated File Access & Deletion Vulnerability

The WordPress Simple-Backup plugin version 2.7.11 is vulnerable to unauthorized file access and deletion attacks. An attacker without any login credentials can manipulate specific parameters in the plugin's backup tool to either download sensitive files like database configurations and backups, or delete critical files such as .htaccess. The vulnerability stems from inadequate validation of user input, allowing attackers to navigate the server's directory structure and target files outside the intended backup folder.

Source data · NVD / CISA · public domain

CVSS
3.1 · 7.5 HIGH · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
CWE-22
Affected products
0 configuration(s)
Published / Modified
2026-06-15 / 2026-06-17

NVD description (verbatim)

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.

2 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

CVE-2016-20076 is a directory traversal vulnerability (CWE-22) in WordPress Simple-Backup 2.7.11 affecting the tools.php file. The delete_backup_file and download_backup_file parameters fail to properly sanitize input, enabling path traversal attacks. Unauthenticated attackers can craft requests using directory traversal sequences to access arbitrary files on the server. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH), reflecting high confidentiality impact with network accessibility and no authentication requirement.

Business impact

Organizations running Simple-Backup 2.7.11 face exposure of their most sensitive data: WordPress database credentials, database dumps, and configuration files that typically contain API keys, authentication tokens, and environment variables. Deletion of .htaccess files removes critical access controls, potentially exposing backup directories to public enumeration and download. Compromise of wp-config.php alone can lead to full database access and privilege escalation, directly enabling data breaches and operational disruption.

Affected systems

WordPress installations with the Simple-Backup plugin version 2.7.11 are vulnerable. The vulnerability is unauthenticated and requires no special network positioning, making any public-facing WordPress site running this plugin version a potential target. Verify your plugin version in WordPress admin settings or via direct inspection of the plugin directory.

Exploitability

This vulnerability is highly exploitable. It requires only network access and can be triggered through simple HTTP requests with no authentication, user interaction, or complex setup. Attackers can immediately download sensitive files or delete critical files to cause denial of service or expose backup repositories. The low attack complexity and absence of prerequisites make this an attractive target for automated scanning and mass exploitation.

Remediation

Immediately update WordPress Simple-Backup to the latest available version beyond 2.7.11. After patching, audit your server for evidence of unauthorized access: review web server logs for suspicious requests to tools.php with unusual delete_backup_file or download_backup_file parameters, verify the integrity of wp-config.php and .htaccess files, and check for unexpected changes to backup directories. Consider temporarily disabling the plugin until patching is complete if you cannot update immediately.

Patch guidance

Contact the Simple-Backup plugin developer or check the WordPress Plugin Directory for version history and security updates. Apply patches during a maintenance window and verify functionality in a staging environment first. After updating, reset any exposed credentials (database passwords, API keys) found in accessible files. Document the timeline of the patch application for compliance reporting.

Detection guidance

Monitor web server access logs (Apache: access.log, Nginx: access.log) for requests to /tools.php containing the parameters delete_backup_file or download_backup_file, particularly those with encoded directory traversal patterns (%2e%2e, ../, etc.). Check file integrity monitoring (FIM) systems for unexpected modifications to wp-config.php, .htaccess, and files in backup directories. Deploy Web Application Firewall (WAF) rules to block requests matching directory traversal payloads targeting the Simple-Backup plugin path.

Why prioritize this

This vulnerability should be patched immediately. The combination of no authentication requirement, trivial exploitation, and high-value targets (database credentials, configuration files) creates an extreme risk profile. The 7.5 CVSS score reflects the severity of data exposure. Attackers can compromise your entire WordPress environment and underlying databases without any barrier to entry.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by: (1) Network attack vector (AV:N) – remotely exploitable from the internet; (2) Low attack complexity (AC:L) – no special conditions or tools required; (3) No privilege required (PR:N) – unauthenticated access; (4) No user interaction (UI:N) – fully automated; (5) High confidentiality impact (C:H) – sensitive files downloaded; (6) No integrity or availability impact scored, though file deletion is possible. The score correctly reflects the critical nature of information disclosure in this scenario.

Frequently asked questions

How can I check if Simple-Backup 2.7.11 is installed on my WordPress site?

Log into your WordPress admin dashboard, navigate to Plugins, and search for 'Simple-Backup' or 'Backup.' Click on it to view the installed version number. Alternatively, connect via SFTP or file manager and navigate to /wp-content/plugins/simple-backup/ and check the plugin header in the main plugin file or readme.txt for the version.

If I cannot update immediately, what interim steps reduce risk?

Deactivate and optionally delete the Simple-Backup plugin until you can update. If you must keep it active, use a Web Application Firewall (WAF) or .htaccess rules to block access to tools.php, restrict access by IP address if the tool is only used from specific locations, and monitor logs aggressively. These are temporary measures—patching is essential.

What files should I prioritize checking after discovering potential exploitation?

Immediately review wp-config.php for unauthorized modifications, check your database for unexpected users or tables, review .htaccess for integrity, inspect backup directories for files accessed outside your backup window, and audit any recent changes to database passwords or API keys stored in configuration. If you find signs of access, assume your database credentials are compromised and rotate them.

Is this vulnerability being actively exploited?

At publication, this vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but absence from that list does not mean exploitation is not occurring. Given the trivial nature of the attack, assume it is or will be targeted by threat actors conducting routine scanning. Prioritize patching as if active exploitation is underway.

This analysis is provided for informational purposes and does not constitute legal or professional security advice. The details, CVE data, and CVSS scores are derived from published sources and the original CVE record as of the publication date. Patch versions and remediation timelines must be verified against the official plugin repository and vendor security advisories. SEC.co and its authors assume no liability for the accuracy, completeness, or applicability of this information to your specific environment. Organizations must conduct their own risk assessment and testing before deploying patches or configuration changes in production systems. Source: NVD (public-domain), retrieved 2026-07-20. Analysis generated by SEC.co (claude-haiku-4-5).

Weaknesses (CWE)

CWE-22

Related vulnerabilities