The BackWPup WordPress plugin contains a Local File Inclusion flaw in the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint. Because the plugin only performs a non‑recursive replacement of path traversal sequences, an attacker can craft a request such as ....// to reference arbitrary files on the server. With sufficient privilege the attacker can read sensitive configuration files or, for certain PHP configurations, execute code, compromising the entire WordPress site. This weakness aligns with CWE‑22, which focuses on path traversal leading to local file inclusion.

All installations of the BackWPup WordPress Backup & Restore Plugin with versions 5.6.6 and earlier are affected. Administrators and any users granted backup‑handling privileges can trigger the vulnerability, allowing lower‑privilege users to craft malicious block_name values. Versions after 5.6.6 and other WordPress plugins are not impacted.

This vulnerability has a CVSS score of 7.2, indicating moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal: an authenticated attacker with administrator or backup‑handling rights can send a crafted request to the vulnerable REST endpoint and induce the server to include an arbitrary local file. Because the traversal sequences are not fully sanitized, the exploitation surface is relatively large and could lead to remote code execution if the server runs the included file. No publicly documented exploits are known, but the lack of full sanitization makes the flaw plausible for compromise.