WordPress Plugin Vulnerabilities on Web Servers Without .htaccess Support
Attack Techniques & Methods2026-10-14, 14:04
WordPress Plugin Vulnerabilities on Web Servers Without .htaccess Support
UltraStrike researchers demonstrated how WordPress plugins that rely on
.htaccess for access control can expose sensitive files when deployed on web servers that do not support it.Apache can use
.htaccess rules to restrict access to files and directories. However, Nginx, Caddy, and IIS do not interpret these rules. If equivalent restrictions are not configured at the web server level, files that would be protected on Apache may become publicly accessible.The researchers demonstrated this problem in two backup plugins. Both scenarios allow unauthenticated downloads under specific conditions.
• Everest Backup: Backup Filename Disclosure
The Everest Backup plugin stores backup archives in
/wp-content/ebwp-backups/, using randomized filenames to make them difficult to guess.
During backup creation, the plugin continuously updates a metadata file named .PROCSTAT. Shortly before the backup finishes, this file reveals the full name of the generated archive. On Apache, .htaccess blocks access to .PROCSTAT, while allowing downloads of .ebwp backup archives. The archives are therefore protected primarily by their unpredictable filenames. On Nginx, Caddy, or another server that ignores .htaccess, an unauthenticated attacker can repeatedly request .PROCSTAT during a backup operation, extract the archive filename, and download the backup containing site files and a copy of the database.The developer claimed to have fixed the issue in version 2.3.13, but UltraStrike's retesting showed that the vulnerability remained. It was still unpatched at the time of publication.
• BackWPup: Database Exposure After Site Restoration
When an administrator restores a backup using BackWPup, the plugin extracts files into:
/wp-content/uploads/backwpup-restore/extract/
Among them is manifest.json, which contains metadata identifying the extracted .sql database backup. On Apache, .htaccess prevents external access to the extraction directory. On web servers that do not support these rules, an unauthenticated attacker can download manifest.json, identify the SQL dump filename, and retrieve the database backup. Because BackWPup did not automatically delete the extracted files after restoration, they could remain accessible for months.
Prerequisite: the administrator must have restored at least one backup. Sites that have never performed a restore do not expose this specific set of files.The issue was fixed in version 5.7.4.
Vendors
Products
More