CVE-2023-7164: high-severity vulnerability in BackWPup
BackWPup < 4.0.4 - Unauthenticated Backup Download
Published · Updated
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 2.3%
exploitation probability
2.3%top 18% of all CVEs
observed exploitation
nono source reports it
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · BackWPupRelated CVEs — BackWPup
In the same product, most dangerous first.
CVE-2026-86815MEDIUMBackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST RoutesEPSS 0.4%CVE-2026-86828—BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip FallbackEPSS —CVE-2026-86827—BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.phpEPSS —CVE-2026-86826—BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINXEPSS —