What’s Vulnerable › Products

wp_media BackWPup – WordPress Backup & Restore Plugin vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your wp_media BackWPup – WordPress Backup & Restore Plugin version is affected

Latest wp_media BackWPup – WordPress Backup & Restore Plugin vulnerabilities

• CVE-2026-86828 — BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback (CVSS 6.6)
• CVE-2026-86827 — BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php (CVSS 5.3)
• CVE-2026-86826 — BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX (CVSS 5.9)
• CVE-2026-86815 — BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes (CVSS 5.5)
• CVE-2026-65443 — WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-6227 — BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter (CVSS 7.2)
• CVE-2025-15041 — BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update (CVSS 7.2)
• CVE-2025-10579 — BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3)
• CVE-2023-5505 — BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal (CVSS 6.8)
• CVE-2023-7164 — BackWPup < 4.0.4 - Unauthenticated Backup Download (CVSS 7.5)
• CVE-2023-5775 — BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password (CVSS 2.7)
• CVE-2023-5504 — BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal (CVSS 8.7)
• CVE-2017-2551 — (CVSS 7.5)