CVE-2021-47979

8.7 highEPSS 0.4%

High (8.7). EPSS 0.4% chance of exploitation in the next 30 days.

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://wordpress.org/plugins/backup-and-restore-for-wp/
https://www.exploit-db.com/exploits/50503
https://www.miniorange.com/
https://www.vulncheck.com/advisories/wordpress-plugin-backup-and-restore-arbitrary-file-deletion

Check your stack JSON