Login Request a demo
Medium severity · published Mar 7, 2023
CVE-2022-4932
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Total Upkeep · Boldgrid
through 1.14.13 · source: NVD
Affected product
TU
Total Upkeep
Boldgrid
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4932
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4932
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2684462%40boldgrid-backup&new=2684462%40boldgrid-backup&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9
More from Total Upkeep
8.2
CVE-2026-66708
WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability
7.5
CVE-2020-36848
Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download
7.5
CVE-2024-24869
WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerability
7.2
CVE-2025-2257
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection
7.2
CVE-2024-9461
Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings