Total Upkeep < 1.17.3 Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable Cron Secret

Vulnerability Overview Vulnerability Name: Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restoration via Predictable (Regression of CVE-2020-36848) Description: This plugin fails to adequately protect the authorization keys for its backup-restoration functionality, allowing unauthenticated users to access sensitive backup information and forcing a full site restoration that overwrites the live site's files and database. CVE ID: CVE-2026-16253 Classification: - Type: Sensitive Data Disclosure - OWASP Top 10: A3: Sensitive Data Exposure - CWE: CWE-200 - CVSS: 7.7 (High) Scope Affected Plugin: boldgrid-backup Fixed Version: 1.17.3 Remediation Fixed Version: Upgrade to version 1.17.3 or higher Timeline Public Disclosure Date: 2026-08-10 Added Date: 2026-08-10 Last Updated Date: 2026-08-10 Additional Information Original Researcher: Jakub Herman Submitter: Jakub Herman Submitter Website: https://www.jakubherman.net Verification Status: Verified WPVDB ID: 97abf25a-48d4-4dfa-a7a3-de88455be7eb Related Vulnerabilities e-shot <= 1.0.2 - Subscriber+ API Token Disclosure Elementor Addons for Elementor < 1.3.0 - Authenticated (Contributor+) Information Exposure JetPopup < 2.0.15.1 - Authenticated (Subscriber+) Information Disclosure Ninja Forms < 3.14.2 - Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint DeepL Pro API Translation < 1.7.5 - API Key Disclosure POC Code POC Code: Will be displayed on September 10, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

Total Upkeep < 1.17.3 Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable Cron Secret

More from this source