Plugin icon

BackWPup – WordPress Backup & Restore Plugin

backwpup

Vulnerabilities:

15

Last Updated:

October 14, 2026

Active Installs:

400000

Published
Title
Fixed in
CVSS
Published
2026-10-06
Title
BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
Fixed in
Fixed in 5.7.7
CVSS
5.9 (medium)
Published
2026-10-06
Title
BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
Fixed in
Fixed in 5.7.7
CVSS
5.3 (medium)
Published
2026-10-06
Title
BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
Fixed in
Fixed in 5.7.7
CVSS
6.6 (medium)
Published
2026-09-09
Title
BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes
Fixed in
Fixed in 5.7.5
CVSS
5.5 (medium)
Published
2026-07-27
Title
BackWPup < 5.7.5 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 5.7.5
CVSS
7.2 (high)
Published
2026-04-13
Title
BackWPup < 5.6.7 - Admin+ Local File Inclusion via 'block_name' Parameter
Fixed in
Fixed in 5.6.7
CVSS
6.5 (medium)
Published
2026-02-18
Title
BackWPup < 5.6.3 - BackWPup Helper+ Privilege Escalation via Arbitrary Options Update
Fixed in
Fixed in 5.6.3
CVSS
7.2 (high)
Published
2025-10-24
Title
BackWPup < 5.5.1 - Missing Authorization to Sensitive Information Exposure
Fixed in
Fixed in 5.5.1
CVSS
3.1 (low)
Published
2024-08-16
Title
BackWPup < 4.0.2 - Admin+ Directory Traversal
Fixed in
Fixed in 4.0.2
CVSS
4.9 (medium)
Published
2023-12-18
Title
BackWPup < 4.0.4 - Unauthenticated Backup Download
Fixed in
Fixed in 4.0.4
CVSS
7.5 (high)
Published
2023-11-22
Title
BackWPup < 4.0.2 - Authenticated (Administrator+) Directory Traversal
Fixed in
Fixed in 4.0.2
CVSS
8.7 (high)
Published
2017-09-08
Title
BackWPup <= 3.4.1 - Backup File Download
Fixed in
Fixed in 3.4.2
CVSS
7.5 (high)
Published
2014-08-01
Title
BackWPup 2.1.4 - Code Execution
Fixed in
Fixed in 2.1.5
CVSS
n/a
Published
2013-06-19
Title
BackWPup <= 3.0.12 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.0.13
CVSS
n/a
Published
2011-03-28
Title
Backwpup < 1.7.2 - Remote File Inclusion
Fixed in
Fixed in 1.7.2
CVSS
n/a