CVE-2020-37246

6.9 mediumEPSS 0.7%

Medium (6.9). EPSS 0.7% chance of exploitation in the next 30 days.

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.2 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-98
Published: 2026-05-16
Modified: 2026-09-29
Record from: the NVD, synced 2026-10-19

References

https://downloads.wordpress.org/plugin/backup-by-supsystic.zip
https://supsystic.com/
https://www.exploit-db.com/exploits/49545
https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion

Check your stack JSON