The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid contains a missing authorization (CWE-862) vulnerability in the 'wp_ajax_cli_cancel' AJAX handler. This flaw exists in all versions up to and including 1.17.1. Because the function lacks a capability check, unauthenticated attackers can invoke it to cancel a pending rollback operation. This prevents the WordPress installation from automatically reverting changes after a failed update, potentially leaving the site in an unstable or inconsistent state. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, no privileges required, no user interaction, and impact limited to integrity.

An attacker without authentication can cancel a pending rollback operation in the affected plugin. This prevents WordPress from automatically reverting a failed update, which may result in the site remaining in a faulty or unstable state. There is no direct impact on confidentiality or availability. The integrity of the update process is compromised, potentially leading to prolonged malfunction or manual recovery efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor plugin updates from BoldGrid and apply them promptly once available. As a temporary measure, restricting access to the AJAX endpoint or disabling the plugin during critical update operations may reduce risk.