Critical vulnerability identified in WordPress plugin “BackupBuddy” (CVE-2022-31474)

This vulnerability is currently being actively exploited with over five million attempts to exploit having been recorded so far.

The flaw exists within the WordPress plugin BackupBuddy (https://ithemes.com/backupbuddy/) and any WordPress instances with the plugin installed may be affected. This vulnerability allows an unauthenticated attacker to view the contents of any file on the affected server that could be read by your WordPress installation. This may include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd.

Affected Versions

• 8.5.8.0 to 8.7.4.1

Remediation

This issue has been remediated in version 8.7.5, all users of the BackupBuddy plugin are advised to upgrade to the latest version available.

References

• https://ithemes.com/blog/wordpress-vulnerability-report-special-edition-september-6-2022-backupbuddy/
• https://www.wordfence.com/blog/2022/09/psa-nearly-5-million-attacks-blocked-targeting-0-day-in-backupbuddy-plugin/

php2shell: moving beyond a lab proof of concept to code execution with ASLR enabled

The Swarm developed a working exploit for php2shell (CVE-2026-109618 and CVE-2026-109619). It achieved unauthenticated remote code execution with address space layout randomization (ASLR) enabled and PHP…

Release: local checker for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

An Open Source host-local vulnerability checker for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell).

PHP2SHELL: Critical PHP vulnerabilities

PHP has released fixes for two critical remote code execution vulnerabilities. This post sets out what PHP has confirmed and what to do now.