LiveActive security incident?Get immediate response
CVE Record

CVE-2020-36848: Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This WordPress plugin flaw can expose backup locations to anyone on the internet. If backup archives are then downloadable, an attacker could obtain sensitive site data. The cited CVSS score is 7.5 because confidentiality impact is high and no login or user interaction is required.

Executive priority

Treat this as urgent for externally hosted WordPress sites because exposed backups can contain credentials, customer data, private content, and configuration secrets. Prioritize internet-facing business sites first, then lower-exposure internal sites.

Technical view

Total Upkeep by BoldGrid versions up to and including 1.14.9 expose sensitive information through env-info.php and restore-info.json. Unauthenticated attackers may learn backup file locations and download backups. The weakness is mapped to CWE-200 and has CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Likely exposure

Exposure is most likely on public WordPress sites running Total Upkeep by BoldGrid at version 1.14.9 or earlier, especially where generated backup metadata or archives are reachable from the web.

Exploitation context

The bundle includes a Rapid7 Metasploit scanner/downloader reference, showing public tooling exists. CISA KEV is false in the provided data, and no cited source in the bundle confirms active exploitation in the wild.

Researcher notes

The provided affected data is inconsistent: the narrative says versions through 1.14.9 are vulnerable, while the affected object lists version 0 with defaultStatus unaffected. Rely on the narrative and referenced vulnerability databases, and verify vendor fixed-version details before closure.

Mitigation direction

  • Inventory WordPress sites for Total Upkeep by BoldGrid installations.
  • Upgrade, disable, or remove affected plugin versions following vendor guidance.
  • Ensure backup metadata files are not publicly accessible.
  • Ensure backup archives are stored outside web-accessible paths.
  • Review BoldGrid and WordPress plugin advisories for fixed-version guidance.

Validation and detection

  • Confirm installed Total Upkeep versions across all WordPress sites.
  • Check whether env-info.php or restore-info.json are publicly reachable.
  • Verify backup archive URLs cannot be downloaded anonymously.
  • Review access logs for unauthenticated requests to backup metadata or archives.
  • Confirm remediation after updating, disabling, or access-restricting the plugin.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-200: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-36848 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2020-36848Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
boldgridTotal Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid0unaffected
Weakness

CWE details

CWE-200

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.