Local File Inclusion Vulnerability in BackWPup Plugin for WordPress by BackWPup

CVE-2026-6227

What is CVE-2026-6227?

The BackWPup plugin for WordPress is subjected to a Local File Inclusion vulnerability that arises from improper sanitization of user inputs. Specifically, within the /wp-json/backwpup/v1/getblock REST endpoint, the block_name parameter does not adequately handle path traversal sequences, leading to potential inclusion of arbitrary PHP files on the server. This flaw allows authenticated users with Administrator permissions to exploit crafted traversal sequences (e.g., ....//), which may enable them to read sensitive files like wp-config.php or, under certain conditions, execute remote code. This vulnerability is particularly concerning as it can be exploited through misconfigured user permissions, compromising the security of WordPress sites.

References