Read the docs
TI-2026-69453 Aliases CVE-2026-86827

Missing authorization in BackWPup lets attackers run backup jobs

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The BackWPup WordPress plugin from 3.3 before 5.7.7 does not verify that a request to its cron-triggered backup execution handler comes from WordPress's internal scheduled-event dispatch, which is a missing authorization check (CWE-862). An unauthenticated remote attacker can force any existing backup job to run immediately, regardless of its configured trigger or schedule. The public record notes an exploit link in its references, and CISA's SSVC data marks the flaw as automatable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed BackWPup (Unknown): 5.7.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownBackWPup3.3 to before 5.7.75.7.7Patch availableCNA
  • BackWPup VendorUnknown Affected 3.3 to before 5.7.7 Fixed in 5.7.7 Patch available CNA

Remediation

Update BackWPup to version 5.7.7 or later, which fixes the flaw. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA BackWPup (Unknown) Fixed in 5.7.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    BackWPup 5.7.7

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-69454 Path traversal in BackWPup WordPress plugin enables file writesPriority LOW 32
    • TI-2026-69452 BackWPup Unauthenticated Data Disclosure via Restore Directory on NGINXPriority LOW 26
    Show all 3 records →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-86827

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences