Vulnerability · Published May 16, 2026 · Assigned by VulnCheck
CVE-2020-37246WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion
Medium 6.2
In plain English
A medium-severity security flaw in Backup from Supsystic. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.
Affected products (as reported)
Weakness: CWE-98 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-49545 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion third-party-advisory