CVE-2015-10134

The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@wordfence.com

Published

2025-07-19

Last modified

2026-04-08

Weaknesses

CWE-22

Affected products

• Simple Backup (Mywebsiteadvisor)

References

• https://packetstormsecurity.com/files/131919/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/29482b70-0ff2-4bb1-9d41-9cffb83b5ad0?source=cve