CVE-2024-12209

Deeper analysis

The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to local file inclusion in all versions through 2.17.0. The flaw exists in the 'umbrella-restore' action handler, where the 'filename' parameter is used without proper sanitization or path validation, allowing an attacker to supply an arbitrary file path that is subsequently included and executed as PHP.

Unauthenticated attackers can exploit the issue over the network by sending a crafted request that references any file readable by the web server process. Successful exploitation grants the ability to execute arbitrary PHP code, bypass access controls, and obtain sensitive data; the impact is especially severe when an attacker can first upload a file containing PHP code that is later included via this vector.

The supplied references point to the vulnerable code in RestoreRouter.php and the corresponding plugin changeset, but contain no explicit mitigation guidance beyond the implied requirement to update beyond version 2.17.0. The EPSS score remains near 0.9 with negligible movement between its recorded peak and current value.