Medium severity · published May 16, 2026
CVE-2020-37246
WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion
6.2
CVSS
0.7%
EPSS
No
On KEV
Description
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Backup · Supsystic
2.3.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37246
downloads.wordpress.org
https://downloads.wordpress.org/plugin/backup-by-supsystic.zip
supsystic.com
https://supsystic.com/
www.exploit-db.com
https://www.exploit-db.com/exploits/49545
www.vulncheck.com
https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion