This host is installed with WordPress BackWPup Plugin and is prone to multiple directory traversal vulnerabilities.

Successful exploitation could allow attackers to perform directory traversal attacks and read arbitrary files on the affected application. Impact Level: Application

Upgrade to WordPress BackWPup Plugin version 1.4.1 or later For updates refer to http://wordpress.org/extend/plugins/backwpup/

Input passed via the 'wpabs' parameter to wp-content/plugins/backwpup/app/options-view_log-iframe.php (when logfile is set to an existing file) and to wp-content/plugins/backwpup/app/options-runnow-iframe.php (when jobid is set to a numeric value) is not properly verified before being used to include files.

WordPress BackWPup Plugin Version prior to 1.4.1

• http://seclists.org/fulldisclosure/2011/Feb/663
• http://secunia.com/advisories/43565
• http://www.osvdb.org/71242
• http://www.osvdb.org/71243

---

Updated on 2015-03-25