Unauthorized File Deletion in BackUpWordPress Plugin
CVE-2026-104307
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-104307?
The BackUpWordPress plugin, prior to version 3.15, is vulnerable due to a lack of necessary capability or nonce checks on specific AJAX actions. As a result, any authenticated user with a minimum role of Subscriber can exploit this weakness to delete crucial backup protection files and disrupt ongoing backup processes. This vulnerability exposes stored backups to unauthorized access and removal, compromising backup integrity and disrupts data restoration efforts.
Affected Version(s)
BackUpWordPress 0 < 3.15
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.