CVE-2026-16253: Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret (regression of CVE-2020-36848)
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16253?
The severity of CVE-2026-16253 is rated at 85, indicating a high risk.
How do I fix CVE-2026-16253?
To fix CVE-2026-16253, upgrade the Total Upkeep plugin to version 1.17.3 or later.
What kind of vulnerability is CVE-2026-16253?
CVE-2026-16253 is an unauthenticated sensitive data disclosure and forced site restore vulnerability.
What can attackers do with CVE-2026-16253?
Attackers can disclose sensitive backup information and force a site restore, compromising the live site's files.
Which plugin is affected by CVE-2026-16253?
The affected plugin is Total Upkeep (BoldGrid Backup) prior to version 1.17.3.