The Keep Backup Daily plugin for WordPress allows an authenticated attacker with Administrator-level or higher privileges to supply an arbitrary file path to the `kbd_open_upload_dir` AJAX action. Because the `kbd_path` parameter is only sanitized with a function that does not remove path traversal sequences, the plugin can reveal the contents of directories outside its designated uploads folder. This vulnerability enables disclosure of sensitive files and configuration data but does not grant code execution or arbitrary file writing. The weakness corresponds to CWE‑22, a classic directory traversal flaw.

This flaw affects every installation of Keep Backup Daily up to and including version 2.1.1. WordPress sites that have installed this plugin and still run a vulnerable version are at risk. Administrators or higher-level users can trigger the exploit by sending a request to the `kbd_open_upload_dir` AJAX endpoint.

Although the CVSS score is only 2.7, indicating a low severity, the attack requires only that an authenticated user exist on the site. The path traversal can be performed remotely via HTTP requests, so the threat vector is web-based. No publicly available exploits were identified in the data, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Nevertheless, because any Site Admin or higher can disclose server file contents, administrators should treat the issue as a medium risk to confidentiality.