CVE-2025-10579: 
WordPress vulnerability analysis and mitigation

CVE-2025-10579 is a missing authorization vulnerability in the BackWPup – WordPress Backup & Restore Plugin, affecting all versions up to and including 5.5.0. The flaw allows authenticated attackers with Subscriber-level access or above to retrieve a backup's filename while a backup is in progress via the unprotected backwpup_working AJAX action. It was disclosed on October 25, 2025, with the CVE assigned by Wordfence. The CVSS v3.1 base score is 5.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the backwpup_working AJAX action handler does not perform a capability check before returning backup status information, including the backup filename (Wordfence). An attacker authenticated as a low-privileged WordPress user (Subscriber or above) can send a crafted AJAX request to this endpoint while a backup is running to obtain the backup filename. This filename can then be leveraged in a brute-force attack to directly access the backup archive on servers using NGINX (which does not block access to backup files by default, unlike Apache's .htaccess protections). The patch is visible in the plugin's SVN changeset (WordPress SVN).

The primary impact is unauthorized disclosure of backup filenames, which on its own has limited value but can facilitate a follow-on brute-force attack to retrieve full backup archives in environments where backup files are web-accessible (particularly NGINX-hosted sites). A successful secondary attack could expose the entire WordPress database, configuration files, credentials, and sensitive site content contained within the backup. There is no integrity or availability impact from this vulnerability directly (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-10579. The EPSS score is approximately 0.027% (0.000270), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability requires authentication (at minimum Subscriber level), which limits the attacker pool, and exploitation is further constrained to NGINX environments where backup files are web-accessible. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain Subscriber-level access: Register or obtain credentials for a low-privileged WordPress account (Subscriber or above) on the target site running BackWPup ≤ 5.5.0.
2. Trigger or wait for a backup: Initiate or wait for a backup job to be running on the target WordPress site, as the filename is only exposed during an active backup.
3. Send AJAX request: While authenticated, send a POST request to the WordPress AJAX endpoint targeting the backwpup_working action (e.g., POST /wp-admin/admin-ajax.php with action=backwpup_working). No additional capability is required.
4. Extract backup filename: Parse the server's response to obtain the backup filename disclosed by the unprotected AJAX handler.
5. Brute-force backup file location: On NGINX-hosted sites where backup files may be web-accessible, attempt to directly download the backup archive using the known filename pattern and common backup storage paths (e.g., /wp-content/uploads/backwpup-*/).
6. Access backup contents: If successful, download and extract the backup archive to obtain database dumps, WordPress configuration files (including wp-config.php with database credentials), and other sensitive data (Wordfence, CleanTalk Research).

• Network: Repeated POST requests to /wp-admin/admin-ajax.php with action=backwpup_working from low-privileged authenticated sessions, especially from unexpected IP addresses.
• Logs: WordPress access logs showing authenticated requests to the backwpup_working AJAX action from Subscriber-level accounts; HTTP GET requests to backup file paths (e.g., /wp-content/uploads/backwpup-*/) from external IPs.
• File System: Unexpected access or download of backup archive files (.zip, .tar.gz) stored in the BackWPup upload directory.
• Process/Application: Backup jobs being triggered at unusual times or frequencies that could indicate an attacker timing their AJAX requests to coincide with active backups.

Users should update the BackWPup – WordPress Backup & Restore Plugin to version 5.5.1 or later, which adds the missing capability check to the backwpup_working AJAX action (WordPress SVN). As a workaround, NGINX administrators should configure their web server to block direct HTTP access to the BackWPup backup storage directory (e.g., deny access to /wp-content/uploads/backwpup-*/). Additionally, configuring BackWPup to store backups outside the web root or to a remote destination (FTP, S3, etc.) eliminates the risk of backup file exposure even if the filename is disclosed.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for October 20–26, 2025, and Sucuri mentioned it in their October 2025 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). Community reaction has been muted given the low severity and limited exploitability of the vulnerability.