Description
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
Published: 2026-10-08
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive data exposure via backup archive download
Action: Apply Patch
AI Analysis

Impact

The BackWPup WordPress plugin before version 5.7.7 fails to restrict web access to its working directory during backup restores. An unauthenticated attacker who can reach the site via a web server that does not honor .htaccess rules, such as NGINX, can download the full backup archive left behind after an interrupted restore. The archive contains the database dump and site files, including credentials and secret keys, resulting in a complete exposure of sensitive data.

Affected Systems

BackWPup plugin for WordPress installations running any version earlier than 5.7.7 on web servers like NGINX that ignore .htaccess. Any site using the backup/restore feature therefore is affected.

Risk and Exploitability

The vulnerability allows unauthenticated download of backup artifacts, leading to confidentiality loss. The attack does not require prior authentication and only needs a web request to the working directory. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The CVSS score is 5.9, indicating a medium severity impact due to complete credential exposure. The primary attack vector is web-based, and the conditions are a running BackWPup plugin in a version older than 5.7.7 on a server that allows unrestricted access to the working directory.

Generated by OpenCVE AI on October 8, 2026 at 12:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade BackWPup to version 5.7.7 or later.
  • Configure the web server to deny access to the BackWPup working directory; for example, add an NGINX location block that returns a 403 or 404 for that path.
  • Delete any leftover backup archives from previous interrupted restores to remove exposed data.

Generated by OpenCVE AI on October 8, 2026 at 12:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions backwpup
Vendors & Products Wordpress-extensions
Wordpress-extensions backwpup

Thu, 08 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Thu, 08 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
Title BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
References

Subscriptions

Wordpress-extensions Backwpup
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-08T10:59:18.387Z

Reserved: 2026-09-08T14:24:10.830Z

Link: CVE-2026-86826

cve-icon Vulnrichment

Updated: 2026-10-08T10:53:19.926Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T06:16:44.617

Modified: 2026-10-08T20:51:18.123

Link: CVE-2026-86826

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:13:12Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor