CVE-2026-86827: falha em BackWPup
BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
Publicada em
0Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Track
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
Produtos afetados
Unknown · BackWPupCVEs relacionadas — BackWPup
No mesmo produto, das mais perigosas para as menos.
CVE-2023-7164HIGHBackWPup < 4.0.4 - Unauthenticated Backup DownloadEPSS 2.3%CVE-2026-86815MEDIUMBackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST RoutesEPSS 0.4%CVE-2026-86828—BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip FallbackEPSS —CVE-2026-86826—BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINXEPSS —