CVE-2020-36848: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerab

Q: How do I fix CVE-2020-36848?

total upkeep: upgrade to 1.14.10. Exact commands for each OS are on this page.

Q: Is CVE-2020-36848 being exploited?

CVE-2020-36848 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2020-36848 affect?

CVE-2020-36848 affects total upkeep. Severity is high (CVSS 7.5). The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files

Q: How urgent is CVE-2020-36848?

Priority 56/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

This week

HIGH 7.5REMOTEUPGRADE

CVE-2020-36848 is a high-severity flaw (CVSS 7.5) affecting total upkeep. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.

Why this priority

High severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.9% (top 21%)
CISA exploited list	No
Weakness	CWE-200
Published	2025-07-12
Last modified	2026-06-17

Publisher (CNA): Wordfence · Vendor: boldgrid

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-07-12 12:15 UTCPublished CVE record published
2026-06-17 03:16 UTCUpdated Record last modified

boldgrid total upkeep UPGRADE

Affected: < 1.14.10

Fixed in: 1.14.10

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy total-upkeep || rpm -q total-upkeep || total-upkeep --version

2. UPGRADE to 1.14.10 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade total-upkeep

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade total-upkeep

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Metasploit: WordPress Total Upkeep Unauthenticated Backup Downloader

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-36848?

total upkeep: upgrade to 1.14.10. Exact commands for each OS are on this page.

Is CVE-2020-36848 being exploited?

CVE-2020-36848 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-36848 affect?

CVE-2020-36848 affects total upkeep. Severity is high (CVSS 7.5). The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files

How urgent is CVE-2020-36848?

Priority 56/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

WordPress vulnerabilities · PHP vulnerabilities

Related CVEs

CVE-2025-2257 HIGH 7.2 UPGRADE The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerab
CVE-2024-9461 HIGH 7.2 UPGRADE The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerab
CVE-2024-24869 HIGH 7.5 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total
CVE-2024-13907 MEDIUM 4.9 UPGRADE The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerab

References

← Back to latest CVEs