Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0060 46.9 —
AFFECTED Product Versions Fixed Simple Backup 2.7.11 – —
TIMELINE Jun 15 Reserved by VulnCheck Jun 15 Published (CNA: VulnCheck) Oct 1 EXPLOIT PUBLISHED — CVE-2016-20076 (ChrisHurst Simple Backup). Public exploit reference added.
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.
| Date | Event | Detail |
|---|---|---|
| June 15, 2026 | Reserved | Reserved by VulnCheck |
| June 15, 2026 | Published | Published (CNA: VulnCheck) |
| October 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2016-20076 (ChrisHurst Simple Backup). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| ChrisHurst | Simple Backup | — | 2.7.11 | — |
Authoritative record: CVE-2016-20076 at cve.org
Vendors: chrishurst
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2016-20076 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
