title: Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload
description: The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
product: WordPress Backup and Migrate Plugin – Backup Guard
vendor: Unknown
versions:
lessThan: 1.6.0, status: affected, version: 1.6.0, versionType: custom
}