Unauthorized Data Access in BackWPup WordPress Backup Plugin

CVE-2025-10579

What is CVE-2025-10579?

The BackWPup plugin for WordPress is susceptible to unauthorized data access due to a lack of proper capability checks on the 'backwpup_working' AJAX action. This vulnerability affects all versions up to and including 5.5.0, allowing authenticated users with Subscriber-level permissions or higher to potentially access the filename of a backup that is currently in progress. While the information on its own may not pose significant risk, it could serve as a stepping stone for attackers to facilitate brute-force attempts against backup contents, particularly in environments using NGINX.

References