Access Control Flaw in BackWPup WordPress Plugin Allows Unauthorized Backup Execution
CVE-2026-86815
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86815?
The BackWPup WordPress plugin, prior to version 5.7.5, contains an access control vulnerability that inadequately restricts access to multiple REST API endpoints. This flaw allows users with limited roles, assigned by an administrator, to create and execute backup jobs. Consequently, hostile actors can exploit this vulnerability to exfiltrate complete database backups to unauthorized destinations, thereby jeopardizing the security of sensitive data.
Affected Version(s)
BackWPup 5.2.2 < 5.7.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.