WordPress Plugin Vulnerabilities

BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php

Description

The plugin does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.

Proof of Concept

Affects Plugins

Plugin icon
backwpup
Fixed in 5.7.7

References

CVE
CVE-2026-86827

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Duy Tran
Submitter
Duy Tran
Submitter website
https://mrdarkroot.github.io/
Submitter twitter
DuyTranWolf
Verified
Yes
WPVDB ID
c7785a5b-f580-416f-a23d-58c28c717b60

Timeline

Publicly Published
2026-10-06 (about 2 days ago)
Added
2026-10-06 (about 1 day ago)
Last Updated
2026-10-06 (about 1 day ago)

Other

Published
Title
Published
2026-03-20
Title
Premmerce Redirect Manager < 1.0.13 - Missing Authorization
Published
2025-12-20
Title
Time Slots Booking Form < 1.2.40 - Missing Authorization
Published
2025-12-30
Title
WpStream < 4.9.6 - Missing Authorization
Published
2026-05-11
Title
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter
Published
2025-09-25
Title
Email marketing for WordPress by GetResponse Official < 1.5.4 - Missing Authorization