WordPress Simple-Backup Directory Traversal File Access

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WordPress Simple-Backup plugin version 2.7.11 and earlier contains a critical directory traversal vulnerability in its tools.php file that allows unauthenticated attackers to arbitrarily read and delete files on affected servers. By manipulating the delete_backup_file and download_backup_file parameters, threat actors can traverse directory structures to access sensitive configuration files like wp-config.php, database dumps, and backup archives—or delete critical files such as .htaccess to expose entire backup directories. This vulnerability affects any WordPress installation using this plugin without authentication requirements, making it a widespread risk for organizations of all sizes relying on this backup solution.

Casky's 331 mapped skills detect this attack pattern by correlating MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery) with Claude AI's extended reasoning to identify suspicious parameter manipulation and path traversal signatures in web traffic and plugin logs. Practitioners using Casky would observe findings highlighting: unexpected directory traversal sequences (../ patterns) in tools.php requests, unauthorized access attempts to wp-config.php and database files, and file deletion operations originating from unauthenticated sessions. The platform's skill set enables detection of the reconnaissance phase where attackers probe for accessible files, followed by exploitation attempts to exfiltrate credentials or delete defensive mechanisms—allowing security teams to block these chains before sensitive data is compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2016-20076.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2016-20076

Casky has 331 skills that investigate the attack patterns behind CVE-2016-20076. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn