How a Simple WordPress Plugin Opened the Door: CVE-2015-10134 Arbitrary File Download Explained

In 2015, a vulnerability in the Simple Backup plugin for WordPress let attackers download sensitive files like wp-config.php from any site running an affected version. For thousands of sites, that put a catastrophic compromise one request away. This post covers the technical details, the real-world impact, and the patch that fixed CVE-2015-10134.

Introduction

WordPress powers over 40% of the web, so its plugins are a prime target for attackers. The Simple Backup plugin was built to help site owners protect their data, and it ironically introduced a critical security risk. In versions up to and including 2.7.10, a flaw in how the plugin handled backup files let unauthenticated users download any file on the server that the web process could read. Attackers could steal database credentials, authentication salts, and other sensitive configuration data, which could lead to a full site takeover.

About the Simple Backup plugin: Simple Backup was a moderately popular WordPress plugin, with around 10,000 active installations at the time of disclosure. It was less widely used than UpdraftPlus or BackWPup, but it served small and medium-sized sites that wanted an easy way to make backups. Its security lagged behind the leading backup plugins, and the project has since been abandoned, which leaves any unpatched installation dangerously exposed.

Technical information

CVE-2015-10134 sits in the download_backup_file function of Simple Backup versions up to and including 2.7.10. The function was meant to let authorized users download backup archives. It did not properly validate user input, and it did not check whether the requester had the necessary permissions.

Vulnerability mechanism

The vulnerable code used the following pattern:

function download_local_backup_file($filename) {
    $filename = ltrim($filename, ".\/"); // Inadequate sanitization
    $file_path = BACKUP_DIR . $filename;
    if (file_exists($file_path)) {
        header("Content-Type: application/octet-stream");
        readfile($file_path); // Arbitrary file read
    }
}

This code has three problems:

• ltrim($filename, ".\/") strips only leading dots and slashes. It does not stop directory traversal sequences like ../../, which can appear elsewhere in the string.
• Nothing verified that the user was authenticated or had permission to download backup files.
• Nothing checked that the requested file was a legitimate backup archive, so attackers could request any file the web server could read.

Attack vectors and exploitation

An attacker could exploit the flaw with a GET request to the plugin's download endpoint, putting a path traversal payload in the download_backup_file parameter. For example:

GET /wp-admin/tools.php?page=backup_manager&download_backup_file=../../wp-config.php

The plugin would respond by serving the site's wp-config.php file, which exposes the database credentials and other sensitive information. The attack needed no authentication and could be run remotely. Public exploit scripts and Metasploit modules made mass exploitation trivial (Exploit-DB 39883, Rapid7).

Root cause

The root cause was a combination of improper input validation, missing authorization checks, and no restriction on file types. The plugin trusted user-supplied file paths and used them in file operations without adequately sanitizing or validating them first. It is a classic example of CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Patch information

The developers of the Simple Backup plugin fixed the arbitrary file download vulnerability in version 2.7.11 with three changes:

1. Capability checks now ensure that only users with appropriate permissions can access backup files, so unauthorized users can no longer abuse the download function.
2. Stricter validation of user input, particularly the download_backup_file parameter, sanitizes the input to block directory traversal sequences.
3. The plugin now verifies the type of each requested file, so only legitimate backup files can be downloaded and sensitive files like wp-config.php stay out of reach.

Patch reference: Patchstack Advisory

Affected systems and versions

The vulnerability affects:

• Product: Simple Backup plugin for WordPress
• Version range: Up to and including 2.7.10
• Configuration: Any WordPress installation with the Simple Backup plugin ≤2.7.10 enabled is vulnerable, regardless of other configuration settings.

Version 2.7.11 and later resolve the issue.

Vendor security history

Simple Backup has a checkered security record. Besides CVE-2015-10134, the plugin has been cited for other critical vulnerabilities, such as arbitrary file deletion. The vendor released a patch for CVE-2015-10134 within two weeks of disclosure, which is a reasonable response time. The plugin has not been updated since 2016, though, and without ongoing maintenance any new vulnerabilities are unlikely to be fixed. It falls short of leading backup plugins like UpdraftPlus and BackWPup in security maturity, and its abandonment leaves users at significant risk.

References

• NVD Entry for CVE-2015-10134
• Official CVE Entry
• Wordfence Vulnerability Advisory
• Packet Storm Security Advisory
• Acunetix Vulnerability Analysis
• Exploit-DB Entry 39883
• Exploit-DB Entry 51937
• Rapid7 Metasploit Module
• Patchstack Advisory

Source: This report was created using AI

If you have suggestions for improvement or feedback, email us at [email protected].