CVE-2022-31474

What it actually does

CVE-2022-31474 is an unauthenticated path traversal vulnerability in iThemes BackupBuddy versions 8.5.8.0 through 8.7.4.1. Because the plugin insufficiently restricts user-supplied file paths to an intended directory, a remote attacker can request arbitrary files from the WordPress server filesystem. The primary impact is confidentiality loss: attackers may read sensitive local files such as WordPress configuration files, database credentials, backup metadata, logs, or other files readable by the web server process. The CVSS vector indicates network exploitation, low complexity, no authentication, and no user interaction, with high confidentiality impact and no direct integrity or availability impact.

Why it matters to the business

Successful exploitation can expose sensitive website and server data, including database passwords and application secrets. If an attacker obtains WordPress configuration or backup-related files, they may be able to pivot to database access, administrative account takeover, data theft, or broader compromise of the hosting environment. The vulnerability is weaponized and has a high EPSS score, meaning exploitation is plausible at internet scale even though it is not currently listed in CISA KEV. Organizations running affected BackupBuddy versions should treat exposed WordPress sites as high-priority remediation targets.

How an attack unfolds

An attacker scans internet-facing WordPress sites for the presence of the iThemes BackupBuddy plugin. If the plugin version is within the vulnerable range, the attacker sends a crafted HTTP request containing directory traversal sequences such as ../ or encoded equivalents to a vulnerable BackupBuddy file handling endpoint. The plugin fails to confine the requested path to the expected backup directory and returns the contents of files accessible to the web server user. The attacker typically attempts to retrieve high-value files such as wp-config.php, backup archives, logs, or other configuration files. Credentials recovered from these files can then be used to access the WordPress database, reuse passwords, impersonate administrators, or support follow-on intrusion activity.

How to fix it

Upgrade iThemes BackupBuddy to a version newer than 8.7.4.1 or the current vendor-supported release. If an upgrade is not immediately possible, disable and remove the BackupBuddy plugin until it can be updated safely. Restrict direct web access to plugin backup and restore functionality where feasible using web server access controls, WAF rules, or IP allowlists. Ensure backup files are stored outside the web root or otherwise inaccessible through direct HTTP requests. Rotate any credentials or secrets that may have been exposed, especially WordPress database credentials found in wp-config.php, API keys, backup encryption keys, and administrative passwords. Review filesystem permissions so the web server process cannot read files outside the minimum required WordPress paths.

How to confirm the fix worked

Confirm that no WordPress installation is running iThemes BackupBuddy versions 8.5.8.0 through 8.7.4.1. Validate plugin versions through the WordPress administrator interface, filesystem plugin metadata, software inventory, or vulnerability scanner results. Where safe and authorized, perform controlled testing for traversal payloads against BackupBuddy endpoints and confirm that requests for files outside the intended backup directory are blocked or return no sensitive content. Verify that backup archives are not publicly accessible under wp-content or plugin directories. Confirm that any compensating WAF or web server rules block traversal patterns including ../, ..%2f, %2e%2e%2f, and double-encoded variants.

Typical attack path

1. Identify internet-facing WordPress sites running iThemes BackupBuddy.
2. Determine whether the installed BackupBuddy version is between 8.5.8.0 and 8.7.4.1.
3. Send crafted HTTP requests with path traversal payloads to BackupBuddy-accessible endpoints.
4. Attempt to read sensitive local files such as WordPress configuration files, backup archives, or server logs.
5. Extract database credentials, salts, secrets, or other sensitive information from retrieved files.
6. Use exposed credentials or secrets for follow-on access, data theft, WordPress takeover, or lateral movement where possible.

How to detect it

Review HTTP access logs, WAF logs, CDN logs, and reverse proxy logs for requests to WordPress BackupBuddy or plugin paths containing path traversal sequences. Focus on unauthenticated GET or POST requests with payloads attempting to access wp-config.php, /etc/passwd, backup archives, logs, or files outside the WordPress directory. Look for encoded traversal variants, repeated probing from the same IP, unusual 200 responses with large byte counts, or responses to requests containing ../ patterns. Review WordPress plugin logs, PHP error logs, and web server logs for file access errors, warnings, or unexpected file reads associated with BackupBuddy endpoints. If exploitation is suspected, examine whether sensitive files were served by comparing request URI, response status, response size, and timestamps. Also investigate subsequent logins, database connections, administrative changes, or credential use following suspicious retrieval attempts.

• ../wp-config.php
• ..%2fwp-config.php
• %2e%2e%2fwp-config.php
• ..%252fwp-config.php
• ../../wp-config.php
• ..%2f..%2fwp-config.php
• %2e%2e/%2e%2e/wp-config.php
• ../etc/passwd
• ../../../../etc/passwd
• ..%2f..%2f..%2f..%2fetc%2fpasswd
• %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
• /wp-content/plugins/backupbuddy/
• /wp-content/uploads/backupbuddy_backups/
• backupbuddy
• wp-config.php
• etc/passwd
• %252e%252e%252f

What your security team should do

• Immediately inventory WordPress sites for the iThemes BackupBuddy plugin and identify versions 8.5.8.0 through 8.7.4.1.
• Upgrade affected installations to a fixed/current BackupBuddy release or remove the plugin if it is not required.
• Prioritize externally exposed WordPress sites because exploitation is unauthenticated, low-complexity, and weaponized.
• Search historical web access logs for traversal attempts against BackupBuddy paths and WordPress configuration files.
• Rotate WordPress database credentials and relevant secrets if logs show suspicious file retrieval attempts or if exposure cannot be ruled out.
• Harden backup storage so backup archives and metadata are not stored in web-accessible directories.
• Add WAF/SIEM detections for path traversal strings targeting WordPress plugin directories, especially BackupBuddy-related paths.