Login Request a demo
Medium severity · published Mar 7, 2023
CVE-2022-4932
Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid · boldgrid
through 1.14.13 · source: vendor
TU
Total Upkeep · Boldgrid
through 1.14.13 · source: NVD
Affected product
TU
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
boldgrid
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4932
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4932
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2684462%40boldgrid-backup&new=2684462%40boldgrid-backup&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9
More from Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
7.5
CVE-2020-36848
Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download
7.2
CVE-2025-2257
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection
7.2
CVE-2024-9461
Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
6.5
CVE-2024-13907
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery
5.3
CVE-2026-3143
Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation