CVE-2025-2257: Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compressionlevel setting. This is due to the plugin using the compressionlevel setting in procopen() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGridto a version that resolves this vulnerability.Fixed in 1.16.10 - Configuration
Remove or restrict usage of the compression_level value in proc_open() by applying validation to compression_level so it cannot be used for command injection (vulnerable in all versions up to and including 1.16.10).
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid (WordPress) compression_level = validated/disabled (do not use unvalidated user-controlled values)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2257?
CVE-2025-2257 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-2257?
To fix CVE-2025-2257, update the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate to version 1.16.11 or higher.
Which versions of the plugin are affected by CVE-2025-2257?
All versions of the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate up to and including version 1.16.10 are affected by CVE-2025-2257.
What type of vulnerability is CVE-2025-2257?
CVE-2025-2257 is categorized as a remote code execution vulnerability.
Who is the vendor for CVE-2025-2257?
The vendor for CVE-2025-2257 is BoldGrid, which develops the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate.