Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: BackWPup 5.7.7 Clear all filters
TI-2026-69454 CVE-2026-86828

Path traversal in BackWPup WordPress plugin enables file writes

Priority LOW 32

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write fil…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00421 Published 2026-10-08 Fixed in 5.7.7 CWE-22
TI-2026-69453 CVE-2026-86827

Missing authorization in BackWPup lets attackers run backup jobs

Priority LOW 29

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated at…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00218 Published 2026-10-08 Fixed in 5.7.7 CWE-862
TI-2026-69452 CVE-2026-86826

BackWPup Unauthenticated Data Disclosure via Restore Directory on NGINX

Priority LOW 26

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rul…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00216 Published 2026-10-08 Fixed in 5.7.7 CWE-200