CVE-2026-16253
Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret (regression of CVE-2020-36848)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.
| Vendor | unknown |
| Product | total upkeep |
| Published | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown total upkeep
Be the first to know when new unknown vulnerabilities affecting unknown total upkeep are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Total Upkeep
0 < 1.17.3
References
Credits
Jakub Herman WPScan