5.3
Medium
CVE-2026-86827 The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution…
Description
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| BackWPup 3.3 | 3.3 → < 5.7.7 | 5.7.7 |
Other CVEs of BackWPup
The 5 CVEs of BackWPup →
CVE-2026-86828
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during…
6.6
Medium
CVE-2026-86826
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses…
5.9
Medium
CVE-2026-86815
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job,…
5.5
Medium
CVE-2023-7164
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing…
7.5
High