CVE-2016-20076

Name of the Vulnerable Software and Affected Versions WordPress Simple-Backup version 2.7.11

Description Insufficient input validation in the 'tools.php' file allows unauthenticated attackers to perform arbitrary file deletion and download sensitive files. By using directory traversal—a technique that allows access to files and directories outside the intended folder—attackers can manipulate the delete backup file and download backup file parameters to access wp-config.php, database dumps, and other sensitive data, or delete critical files such as .htaccess to expose backup directories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.