WordPress Plugin Vulnerabilities

BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error

Description

The plugin does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the plugin's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups.

Proof of Concept

Affects Plugins

Plugin icon
backupwordpress
Fixed in 3.15

References

CVE
CVE-2026-104307

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Suhayb Ahmed (cyboltx)
Submitter
Suhayb Ahmed (cyboltx)
Verified
Yes
WPVDB ID
fdd1c029-f055-40c0-9c7f-a0a3822304a9

Timeline

Publicly Published
2026-11-06 (about 2 days ago)
Added
2026-11-06 (about 1 day ago)
Last Updated
2026-11-06 (about 1 day ago)

Other

Published
Title
Published
2026-04-21
Title
HTTP Headers < 1.19.3 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
Published
2026-07-02
Title
TinyPNG < 3.6.14 - Author+ Arbitrary File Deletion via convert.path in tiny_compress_images Post Meta
Published
2026-11-05
Title
Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field
Published
2025-06-10
Title
WP-DownloadManager < 1.68.11 - Admin+ Arbitrary File Deletion
Published
2025-03-21
Title
Export and Import Users and Customers < 2.6.3 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function