Unauthenticated Backup Trigger Vulnerability in BackWPup WordPress Plugin
CVE-2026-86827
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86827?
The BackWPup plugin for WordPress, prior to version 5.7.7, is susceptible to a vulnerability that permits unauthenticated attackers to trigger backup jobs on the system. By exploiting this flaw, attackers can initiate any scheduled backup task regardless of its original trigger conditions or timing. This exploitation poses significant risks as it allows unauthorized actors to execute backup processes without appropriate authentication, potentially leading to data exposure or corruption.
Affected Version(s)
BackWPup 3.3 < 5.7.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.