Vulnerability record · CVE-2022-31474 · published 13 March 2023
CVE-2022-31474: BackupBuddy WordPress plugin path traversal allows arbitrary file download
Ithemes · Backupbuddy
BackupBuddy versions 8.5.8.0 through 8.7.4.1 contain a path traversal flaw (CWE-22) that lets a remote attacker read files outside the intended directory. Because the plugin handles backups and configuration, exposed files can include sensitive data. The vendor and Patchstack advisories confirm the issue and the affected range.
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file disclosure with a high EPSS percentile, though not in KEV and with no confirmed public exploit in this record.
What it is
BackupBuddy versions 8.5.8.0 through 8.7.4.1 contain a path traversal flaw (CWE-22) that lets a remote attacker read files outside the intended directory. Because the plugin handles backups and configuration, exposed files can include sensitive data. The vendor and Patchstack advisories confirm the issue and the affected range.
Impact
An unauthenticated attacker can download arbitrary files from the server, exposing configuration, credentials and backup contents. There is no integrity or availability impact per the CVSS vector; the loss is confidentiality.
Attack surface
Reachable over the network with no authentication and no user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N). The flaw is in the plugin's file-handling path, so any site running an affected version is exposed.
Exploitation
Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.63761, 99.18th percentile), indicating elevated likelihood of exploitation. Both references are advisory-only, so no public exploit code is confirmed by this record.
What to do
- Update BackupBuddy to a version above 8.7.4.1 as soon as possible.
- If patching is delayed, disable or remove the BackupBuddy plugin until it can be updated.
- Restrict access to plugin endpoints with a WAF or server rules blocking traversal sequences in requests.
- Rotate any credentials or secrets that may have been stored in files reachable through the plugin.
- Review server and plugin logs for suspicious file-download requests against BackupBuddy paths.
Detection
- Search web logs for requests to BackupBuddy endpoints containing '../' or encoded traversal sequences.
- Alert on downloads of sensitive files such as wp-config.php, .env or backup archives via plugin URLs.
- Monitor for unexpected outbound or repeated file-retrieval requests from the WordPress host.
- Inventory WordPress installs for BackupBuddy versions in the 8.5.8.0 to 8.7.4.1 range.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-31474 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-31474), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
