CVE-2024-0842 is a high severity (CVSS 7.5) denial of service in the Backuply backup plugin for WordPress, all versions up to and including 1.2.6. Unauthenticated visitors can exhaust server resources through restore_ins.php. Update to a release later than 1.2.6.
What's affected
The Backuply backup, restore, migrate and clone plugin for WordPress, all versions up to and including 1.2.6. The record says the file backuply/restore_ins.php can be reached directly, so unauthenticated attackers can send excessive requests that run the server out of resources.
The references include plugin changesets, so a later release has the change, but the record does not name the version. Check the changelog.
The record classifies the weakness as CWE-400 (uncontrolled resource consumption) and CWE-834 (excessive iteration). NVD scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
How to check if you're exposed
Plugins are the usual blind spot on a WordPress estate, so start with an inventory. If you have shell access and WP-CLI, this lists every plugin with its version and status:
wp plugin list --fields=name,status,version,update
Look for Backuply in the output and compare the version to the range above. Without WP-CLI, open Plugins in the dashboard and read the version under the plugin name. Do this on every site, including staging copies and old multisite installs, because inactive plugins still sit on disk and some can be reached directly by URL.
The free in-browser dependency scan covers application dependencies in your repositories. It does not read a live WordPress install, so use the plugin list for this one.
What to do now
- Update Backuply to a version later than 1.2.6.
- If you cannot update now, block direct requests to restore_ins.php at the web server or firewall.
- Add rate limiting for the site and watch resource graphs for sudden load.
- Keep the plugin only if you use it. Remove it if backups run elsewhere.
Why it matters
The record lists uncontrolled resource consumption (CWE-400) and excessive iteration (CWE-834). A file meant for an internal restore step can be called by anyone, and each call does real work.
Availability bugs rarely steal data, but a backup plugin that takes down the site during an incident is a real problem.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
Plugin versions drift over time. This demo shows how continuous monitoring flags a dependency the day a new advisory lands.
Click through it at your own pace, or open it full screen.
Quick check
Can a firewall rule replace the update?
It can reduce the exposure while you plan, but the plugin fix is the lasting answer.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
- plugins.trac.wordpress.org
- plugins.trac.wordpress.org
- www.wordfence.com
- Safeguard Gold entry for CVE-2024-0842
Last reviewed: 19 October 2026.
