Backup Functionality Vulnerability in Total Upkeep WordPress Plugin
CVE-2026-16253
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16253?
The Total Upkeep plugin for WordPress, prior to version 1.17.3, is susceptible to an insecure direct object reference, resulting in inadequate protection of backup-restore functionality secrets. This flaw allows unauthenticated users to access sensitive backup data and potentially initiate a full site restore, which could overwrite existing files and database content on the live site, leading to possible data loss and disruption.
Affected Version(s)
Total Upkeep 0 < 1.17.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.