Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
Strategic Overview
- Status
- Patched in 1.16.7
- Affected Version
<= 1.16.6- CVSS
- 7.2High
- Weakness type
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CVE
CVE-2024-9461
At a glance
CVE-2024-9461 is a high-severity Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the Total Upkeep WordPress plugin, affecting versions <= 1.16.6. It carries a CVSS score of 7.2 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires an authenticated account at Administrator level or above. The issue is fixed in version 1.16.7; sites on affected versions should update now. Disclosed November 2024, reported by Jonas Benjamin Friedli.
Vulnerability Overview
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Remediation
Update to version 1.16.7, or a newer patched version
How does WordSec protect against this?
An attacker needs Administrator access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: Total Upkeep 1.16.7 closes this, and updating the plugin is the step that ends it.
- Firewall
- Scanner
- Alerts
External References
Related records
Same weakness class
Other vulnerabilities in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- 7.5CVE-2024-24869: Total Upkeep Improper Authorization
CVE-2024-24869 - 7.5CVE-2020-36848: Total Upkeep by BoldGrid <= 1.14.9 Backup Download
CVE-2020-36848 - 5.3CVE-2026-16253: Total Upkeep Information Exposure
CVE-2026-16253 - 5.3CVE-2026-66708: Total Upkeep Missing Authorization
CVE-2026-66708 - 5.3CVE-2026-3143: Total Upkeep Unauthenticated Rollback Cancellation
CVE-2026-3143 - 4.9CVE-2024-13907: Total Upkeep SSRF
CVE-2024-13907 - 4.3CVE-2022-4932: Total Upkeep Authenticated (Subscriber+) Information
CVE-2022-4932
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C