Security readout for executives and security teams
Plain-English summary
A logged-in WordPress user with even Subscriber rights could make Total Upkeep reveal backup file paths. Those paths may help them download backups, exposing site data. This is not described as unauthenticated code execution, but backups often contain sensitive site data, so affected sites should remediate promptly.
Executive priority
Treat this as a moderate data-exposure issue. It is lower urgency than unauthenticated remote code execution, but backup disclosure can expose databases, credentials, and business data. Prioritize internet-facing WordPress sites with many user accounts or public registration.
Technical view
CVE-2022-4932 is a missing authorization flaw in Total Upkeep's heartbeat_received() function, triggered through WordPress Heartbeat. Versions up to and including 1.14.13 are reported vulnerable. Authenticated users with Subscriber-level permissions or higher may retrieve backup paths, creating an information-disclosure risk. CVSS 3.1 score is 4.3, mapped to CWE-862.
Likely exposure
Exposure is limited to WordPress sites running the Total Upkeep plugin at version 1.14.13 or earlier and allowing low-privilege authenticated accounts. Sites with public registration, many subscribers, or sensitive backups have higher practical risk.
Exploitation context
The provided sources do not report known active exploitation, and the CVE is not listed as KEV. Exploitation requires authenticated WordPress access at Subscriber level or above, then abuse of missing authorization in the heartbeat handler to expose backup path information.
Researcher notes
The source bundle identifies the vulnerable function and privilege requirement but does not include proof-of-concept details or active exploitation evidence. The affected range is stated as up to and including 1.14.13; fixed-version confirmation should come from the vendor change record or advisory.
Mitigation direction
- Check whether Total Upkeep is installed and at version 1.14.13 or earlier.
- Update Total Upkeep to a vendor-supported version newer than the vulnerable range.
- Review vendor and Wordfence guidance for the confirmed fixed release details.
- Limit unnecessary WordPress Subscriber-level accounts, especially where public registration is enabled.
- Ensure backups are not directly downloadable without proper authorization.
Validation and detection
- Inventory WordPress sites for the Total Upkeep plugin and record installed versions.
- Confirm low-privilege authenticated users cannot retrieve backup path information through heartbeat behavior.
- Review web server access logs for unusual authenticated requests around backup resources.
- Check backup storage locations for direct public access or weak authorization controls.
- Document remediation status for each affected WordPress instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-4932 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2684462%40boldgrid-backup&new=2684462%40boldgrid-backup&sfp_email=&sfph_mail=CVE reference
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9CVE reference · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.