CVE-2026-86827: fallo en BackWPup
BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
Publicada el
0Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Track
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
Productos afectados
Unknown · BackWPupCVEs relacionadas — BackWPup
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-7164HIGHBackWPup < 4.0.4 - Unauthenticated Backup DownloadEPSS 2.3%CVE-2026-86815MEDIUMBackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST RoutesEPSS 0.4%CVE-2026-86828—BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip FallbackEPSS —CVE-2026-86826—BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINXEPSS —