CVE-2021-24155: WordPress Backup Guard plugin arbitrary file upload leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with public exploit code and very high EPSS, but it requires an already privileged admin+ account, which limits the attack population.

What it is

The Backup Guard WordPress plugin before 1.6.0 failed to validate that imported files were of the expected SGBP format and extension. This lets an admin-level user upload arbitrary files, including PHP, into the site. Because the uploaded PHP can be executed, the flaw turns a privileged account into remote code execution on the web server.

Impact

An attacker with admin+ access gains remote code execution on the WordPress host, enabling full compromise of the site and potentially the underlying server.

Attack surface

Reached over the network through the plugin's import functionality; the CVSS vector requires high privileges (PR:H) and no user interaction (UI:N). Only authenticated admin+ users can trigger it.

Exploitation

Public exploit code is referenced (Packet Storm and WPScan entries tagged Exploit), and EPSS is very high at 0.841 (99.68th percentile), though the CVE is not listed in CISA KEV.

What to do

• Update the Backup Guard plugin to version 1.6.0 or later.
• Restrict admin-level accounts to the minimum necessary personnel and enforce strong authentication.
• Disable or remove the plugin if it is not actively needed.
• Monitor and restrict file uploads to expected backup formats and block PHP execution in upload directories.

Detection

• Alert on PHP files appearing in WordPress upload or backup directories.
• Review plugin import/restore activity logs for unexpected or malformed file uploads.
• Monitor web server logs for POST requests to Backup Guard import endpoints followed by access to newly written PHP files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.