CVE-2015-10134
📋 TL;DR
The Simple Backup WordPress plugin allows attackers to download any file from the server without authentication due to missing security checks. This affects WordPress sites using Simple Backup versions 2.7.10 and earlier. Attackers can steal sensitive configuration files and other critical data.
💻 Affected Systems
- Simple Backup WordPress Plugin
📦 What is this software?
Simple Backup by Mywebsiteadvisor
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via database credentials theft from wp-config.php, leading to data exfiltration, site defacement, or ransomware deployment.
Likely Case
Database credentials and other sensitive configuration data stolen, potentially leading to database compromise and site takeover.
If Mitigated
Limited impact if proper file permissions and web server configurations prevent access to critical files.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication. Attackers can directly request backup files via crafted URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.11 or later
Vendor Advisory: https://wordpress.org/plugins/simple-backup/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Simple Backup and click 'Update Now'. 4. Verify version is 2.7.11 or higher.
🔧 Temporary Workarounds
Disable Simple Backup Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate simple-backup
Restrict Access via .htaccess
linuxBlock access to the vulnerable endpoint using web server rules.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-content/plugins/simple-backup/.*\.php$ - [F,L]
</IfModule>
🧯 If You Can't Patch
- Remove the Simple Backup plugin completely from the WordPress installation.
- Implement web application firewall rules to block requests to the vulnerable download_backup_file endpoint.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Simple Backup version. If version is 2.7.10 or lower, you are vulnerable.Check Version:
wp plugin get simple-backup --field=versionVerify Fix Applied:
Verify Simple Backup plugin version is 2.7.11 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/plugins/simple-backup/download_backup_file.php with file parameter
- Unusual file downloads from backup directories
Network Indicators:
- GET requests for wp-config.php or other sensitive files from plugin paths
SIEM Query:
url:*/wp-content/plugins/simple-backup/download_backup_file.php* AND (file:*wp-config* OR file:*config*)