CVE-2025-2257: boldgrid total_upkeep OS Command Injection

Vulnerability summary

CVE-2025-2257 is a high (CVSS 7.2) OS Command Injection vulnerability in boldgrid total_upkeep. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 58.1% of scored vulnerabilities. Fixed in 1.17.0.

Timeline

1. 26-03-2025
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.