WordPress Plugin Vulnerabilities

BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback

Description

The plugin does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
backwpup
Fixed in 5.7.7

References

CVE
CVE-2026-86828

Classification

Type
TRAVERSAL
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
6.6 (medium)

Miscellaneous

Original Researcher
Bhaveshkumar Parmar
Submitter
Bhaveshkumar Parmar
Verified
Yes
WPVDB ID
be8c0eab-1874-4490-b94e-394f62a522f3

Timeline

Publicly Published
2026-10-06 (about 2 days ago)
Added
2026-10-06 (about 1 day ago)
Last Updated
2026-10-06 (about 1 day ago)

Other

Published
Title
Published
2026-09-14
Title
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
Published
2021-09-02
Title
Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal
Published
2018-10-27
Title
ARForms < 3.5.2 - Unauthenticated Arbitrary File Deletion
Published
2026-08-17
Title
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
Published
2023-02-28
Title
GMace <= 1.5.2 - Admin+ Path Traversal