The BackUpWordPress plugin suffers from a CWE-22 improper limitation of a pathname to a restricted directory vulnerability. Authenticated administrators can exploit the hmbkp_directory_browse parameter to perform directory traversal, accessing files and directories outside the plugin's intended scope. This could lead to limited information disclosure but does not affect integrity or availability. The CVSS 3.1 base score is 2.7, reflecting low severity with network attack vector, low complexity, and high privileges required.

The vulnerability allows authenticated administrators to read files outside the plugin's directory scope, potentially exposing sensitive information. There is no impact on data integrity or availability. The low CVSS score reflects the limited scope and required high privileges, reducing the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to directory browsing within the plugin. Avoid exposing the WordPress admin interface to untrusted networks.