WordPress plugin Backup Bolt 安全漏洞

WordPress Backup Bolt plugin is a backup plugin for WordPress websites, mainly used to automate the backup of website data including files, databases, etc., and support the recovery function. WordPress Backup Bolt plugin has an arbitrary file download vulnerability, which stems from a flaw in the...

The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial of Service (DoS) via a crafted input.

...

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.

...

Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better Security" guidance.

...

Controller/Async/FilesystemManager.php in the filemanager in Bolt allows remote attacke

...

Bolt before 3.3.6 does not properly restrict access to _profiler routes

...

The filename of uploaded files vulnerable to stored XSS in Bolt CMS

...

CSRF issue on preview pages in Bolt CMS

...

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log

...

Bolt before 3.6.10 has XSS via an image's alt or title field.

...

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php

...

The theme editor in Bolt allows remote authenticated users to execute arbitrary code by renaming a crafted file

...

CVE-2025-49040

Cross-Site Request Forgery CSRF vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through = 1.5.0...

CVE-2025-49040

Cross-Site Request Forgery CSRF vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through = 1.5.0...

CVE-2025-49040

CVE-2025-49040 is a CSRF vulnerability in the WordPress plugin Backup Bolt. Public details indicate it affects versions up to 1.4.1 (initial description), with Patchstack noting vulnerable versions up to 1.5.0. CVSS 3.1 base score 4.3 (Medium) with network attack vector, low attack complexity, no...

CVE-2025-49040 WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through = 1.5.0...

CVE-2025-49040 WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through = 1.5.0...

WordPress plugin Backup Bolt 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

PT-2025-34826 · Unknown · Backup Bolt

Name of the Vulnerable Software and Affected Versions: Backup Bolt versions through 1.4.1 Description: Backup Bolt is susceptible to a Cross-Site Request Forgery CSRF issue, which allows attackers to perform actions on behalf of authenticated users. Recommendations: Update Backup Bolt to a versio...

Linux Distros Unpatched Vulnerability : CVE-2021-27022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should...