5.3
Moyenne
CVE-2026-86827 The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution…
Description
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| BackWPup 3.3 | 3.3 → < 5.7.7 | 5.7.7 |
Autres CVE de BackWPup
Les 5 CVE de BackWPup →
CVE-2026-86828
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during…
6.6
Moyenne
CVE-2026-86826
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses…
5.9
Moyenne
CVE-2026-86815
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job,…
5.5
Moyenne
CVE-2023-7164
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing…
7.5
Élevée