CVE-2025-10579

The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'backwpup_working' AJAX action in all versions up to, and including, 5.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve access to a back-up's filename while a backup is running. This information has little value on it's own, but could be used to aid in a brute force attack to retrieve back-up contents in limited environments (i.e. NGINX).

• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3381187%40backwpup%2Ftrunk&old=3362645%40backwpup%2Ftrunk&sfp_email=&sfph_mail=#file23
• https://research.cleantalk.org/cve-2025-10579
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9a1484-2000-47fa-9890-fa02eddabcd9?source=cve

Published

Oct 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10572Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-10573Stored XSS in Ivanti Endpoint Manager prior to version 2024 …6.1
• CVE-2025-10575The WP jQuery Pager plugin for WordPress is vulnerable to SQ…6.5
• CVE-2025-10576Potential vulnerabilities have been identified in the audio …8.5
• CVE-2025-10577Potential vulnerabilities have been identified in the audio …8.5
• CVE-2025-10578A potential security vulnerability has been identified in th…7.8
• CVE-2025-1058CWE-494: Download of Code Without Integrity Check vulnerabil…8.1
• CVE-2025-10580The Widget Options – The #1 WordPress Widget & Block Control…6.4
• CVE-2025-10581A potential DLL hijacking vulnerability was discovered in th…8.5
• CVE-2025-10582The WP Dispatcher plugin for WordPress is vulnerable to SQL …8.8
• CVE-2025-10583The WP Fastest Cache Premium plugin for WordPress is vulnera…3.5
• CVE-2025-10584A vulnerability was identified in Portabilis i-Educar up to …5.4