Access violation vulnerability in BackWPup – WordPress Backup Plugin 4.0.1

The BackWPup plugin for WordPress has a security vulnerability in versions up to and including 4.0.1. This vulnerability, called Directory Traversal, could allow an authenticated attacker to store backups in any folder on the server that the server can write to. The plugin’s default settings will also create an index.php and a .htaccess file in the chosen directory when the first backup job runs. This is meant to prevent people from viewing or accessing the files. However, if the attacker sets the backup directory to the root of another site in a shared environment, then they could disable that site.