What’s Vulnerable › Vulnerabilities

CVE-2015-10134: Simple Backup <= 2.7.10 - Arbitrary File Download via Path Traversal

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-19 · updated 2026-06-17
• Weakness: CWE-22

Description

The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.

Affected products

• mywebsiteadvisor Simple Backup: through 2.7.10

References

• https://packetstormsecurity.com/files/131919/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/29482b70-0ff2-4bb1-9d41-9cffb83b5ad0?source=cve

Get alerted when CVE-2015-10134 or the next vulnerability affects your stack