What’s Vulnerable › Vulnerabilities
CVE-2026-86826: BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-08 · updated 2026-10-08
- Weakness: CWE-200
Description
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
Affected products
- wp_media BackWPup – WordPress Backup & Restore Plugin: before 5.7.7 — fixed in 5.7.7
How to fix
Upgrade to a fixed version: wp_media BackWPup – WordPress Backup & Restore Plugin 5.7.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86826 or the next vulnerability affects your stack