CVE-2016-20076 — WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download

Back Back to CVE browser

HIGH

WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download

Published Jun 15, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.60%

Description

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.

Affected products

Vendor ChrisHurst Product Simple Backup Default
n/a
- Version
  2.7.11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ChrisHurst

Simple Backup

n/a

Version	Status	Constraints
2.7.11	affected	-

Remediation

No remediation recorded yet.

Metrics

0.60% 0.00601

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00601

Score over time

Jun–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.60% (0.00601)	46.84th	v5 (v2026.06.15)
Jun 16, 2026	0.60% (0.00601)	43.96th	v5 (v2026.06.15)

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://www.exploit-db.com/exploits/39883
exploit
https://www.vulncheck.com/advisories/wordpress-simple-backup-arbitrary-file-deletion-and-download
third-party-advisory

Link	Providers	Tags
https://www.exploit-db.com/exploits/39883		exploit
https://www.vulncheck.com/advisories/wordpress-simple-backup-arbitrary-file-deletion-and-download		third-party-advisory