CVE-2021-47979

High

Published: 16/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The WordPress Plugin Backup and Restore version 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests.

Risk Assessment

Attackers can delete arbitrary files from the WordPress installation directory, potentially leading to serious security and data integrity issues.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.