CVE-2020-37246 - CVE House
Back to Database
Status published Medium CVE-2020-37246

WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion

Vulnerability Description

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-37246

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Erik David Martin

References

More from Supsystic

View All →
CVE-2024-47330
Broken Access Control vulnerability on multiple WordPress plugins by Supsystic
Medium 4.3
CVE-2024-33910
WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Broken Access Control vulnerability
Medium 5.3
CVE-2024-32829
WordPress Data Tables Generator by Supsystic plugin <= 1.10.31 - Broken Access Control vulnerability
Medium 4.3
CVE-2024-32790
WordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerability
Medium 4.3
CVE-2024-32089
WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability
Medium 4.3

Affected Vendor

Affected Software

Backup
Vulnerable Versions:
2.3.9

Timeline

Official Publish: May 16th, 2026
Last Modified: May 18th, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-98

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505 Server Software Component
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1005 Data from Local System
Collection