The BackWPup WordPress plugin before version 5.7.7 fails to constrain the destination path used when extracting files during a backup restore that relies on its fallback archive library. This flaw permits administrators to write files outside the intended restore directory, effectively allowing them to place arbitrary code on the server and execute it. The vulnerability is a direct path‑traversal weakness that can lead to full remote code execution if attacker‑controlled files are injected into the plugin’s working area.

The plugin BackWPup versions earlier than 5.7.7 are affected. The issue exists across all platforms where the plugin is installed and the fallback restore mechanism is utilized; no vendor name is listed in the CNA data, so all installations of the unpatched BackWPup plugin are potentially vulnerable.

EPSS Score: < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV. The CVSS score of 6.6 classifies it as medium severity, although the unrestricted file writes and potential for arbitrary code execution remain concerning. The likely attack vector is a locally privileged administrator who can trigger the backup restoration process. Without patching, malicious actors can craft a restore job that places exploit files into critical directories. The absence of a public exploit or KEV listing does not diminish the risk to affected sites because the attack requires administrative access, which is often present on compromised or poorly secured WordPress installations.