CVE-2024-0842
📋 TL;DR
The Backuply WordPress plugin is vulnerable to Denial of Service attacks in versions up to 1.2.5. Unauthenticated attackers can directly access the restore_ins.php file and make excessive requests, causing server resource exhaustion. All WordPress sites using vulnerable Backuply versions are affected.
💻 Affected Systems
- Backuply – Backup, Restore, Migrate and Clone WordPress plugin
📦 What is this software?
Backuply by Softaculous
⚠️ Risk & Real-World Impact
Worst Case
Complete website unavailability due to server resource exhaustion, potentially affecting all hosted sites on shared hosting environments.
Likely Case
Website performance degradation or temporary unavailability during attack periods.
If Mitigated
Minimal impact with proper rate limiting and resource monitoring in place.
🎯 Exploit Status
Simple HTTP requests to the vulnerable endpoint can trigger the DoS condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.6
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3033242/backuply/trunk/restore_ins.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Backuply plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.2.6+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Block direct access to restore_ins.php
linuxAdd .htaccess rule to block direct access to the vulnerable file
# Add to .htaccess in WordPress root directory
<Files "restore_ins.php">
Order Allow,Deny
Deny from all
</Files>
Web Application Firewall rule
allBlock requests to /wp-content/plugins/backuply/restore_ins.php
🧯 If You Can't Patch
- Temporarily disable the Backuply plugin until patching is possible
- Implement rate limiting at web server or CDN level to prevent excessive requests
🔍 How to Verify
Check if Vulnerable:
Check if /wp-content/plugins/backuply/restore_ins.php is accessible without authentication via curl or browserCheck Version:
grep -r "Version:" wp-content/plugins/backuply/backuply.php | head -1Verify Fix Applied:
Verify Backuply plugin version is 1.2.6 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- High frequency of requests to /wp-content/plugins/backuply/restore_ins.php
- Server error logs showing resource exhaustion (memory, CPU)
Network Indicators:
- Unusual traffic patterns to the restore_ins.php endpoint
- Multiple requests from single IPs in short timeframes
SIEM Query:
source="web_access_logs" AND uri_path="/wp-content/plugins/backuply/restore_ins.php" | stats count by src_ip | where count > 100🔗 References
- https://plugins.trac.wordpress.org/changeset/3033242/backuply/trunk/restore_ins.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1f955d88-ab4c-4cf4-a23b-91119d412716?source=cve
- https://plugins.trac.wordpress.org/changeset/3033242/backuply/trunk/restore_ins.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1f955d88-ab4c-4cf4-a23b-91119d412716?source=cve
