File Download Exposure in BackWPup Plugin for WordPress
CVE-2026-86826
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86826?
The BackWPup plugin for WordPress, prior to version 5.7.7, suffers from improper access control, allowing unauthorized users to access the plugin's working directory. This flaw enables unauthenticated attackers to download backup archives containing sensitive information like database dumps, site files, credentials, and secret keys. This issue is particularly severe on servers, such as those running NGINX, that do not respect .htaccess rules, potentially leading to data breaches and exploitation of the compromised backups.
Affected Version(s)
BackWPup 0 < 5.7.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.