Cyber Posture

CVE-2025-2257

High

Published: 26 March 2025

Published
26 March 2025
Modified
22 May 2025
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0166 82.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2025-2257 is a remote code execution vulnerability affecting the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid for WordPress, in all versions up to and including 1.16.10. The flaw stems from the plugin's use of the unvalidated compression_level setting in a proc_open() call within the compressor component, specifically in the class-boldgrid-backup-admin-compressor-system-zip.php file. This issue is classified under CWE-78 (OS Command Injection) and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2025-03-26.

Authenticated attackers with administrator-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By manipulating the compression_level parameter, they can inject malicious commands via proc_open(), leading to arbitrary code execution on the server and potentially full compromise of the hosting environment, including high confidentiality, integrity, and availability impacts.

Advisories and patch references, including Wordfence threat intelligence and plugin repository changesets, point to mitigations via code updates. A fix is detailed in BoldGrid's GitHub pull request #622, with related changes in WordPress plugin SVN tag 1.16.7 and Trac changeset 3257988 for the boldgrid-backup repository, which address the lack of validation on the compression_level input in the ZIP compressor class. Security practitioners should update to versions beyond 1.16.10 where available.

Details

CWE(s)
CWE-78

Affected Products

boldgrid
total upkeep
≤ 1.17.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

OS command injection via unvalidated input in proc_open() in public-facing WordPress plugin enables remote authenticated RCE, directly mapping to exploitation of public-facing applications and Unix shell command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References