CVE-2024-12209

The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress, in all versions up to and including 2.17.0, contains an unauthenticated local file inclusion flaw (CWE-98) in the 'filename' parameter of the 'umbrella-restore' action. An attacker with no privileges or prior access sends a crafted request to this action, causing the server to include and execute an attacker-influenced local file path. Successful exploitation lets the attacker execute any PHP code present in includable files, bypass access controls, and read sensitive data; if the site permits uploads of otherwise 'safe' file types (such as images) that can contain PHP and be included, this escalates to full remote code execution. Any WordPress site running the plugin at version 2.17.0 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA's KEV catalog, but the EPSS score of 23.4% (98th percentile) indicates an elevated probability of exploitation in the next 30 days.

What to do: Update the WP Umbrella plugin to the latest patched release (any version after 2.17.0) immediately; until patched, deactivate the plugin or block unauthenticated requests containing the 'umbrella-restore' action via a WAF or firewall rule. Review web/access logs for requests to the umbrella-restore action with unusual or path-traversal-style 'filename' values, and audit uploaded files that could be used for PHP execution.