MEDIUM 5.9 NVD

CVE-2026-86826

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthentica

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.

References

https://wpscan.com/vulnerability/ee9f0772-ac6f-4e2d-a2c0-cc8892291932/

Published: 2026-10-08 · Source: NVD · Feed updated: 2026-10-12

This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-10-08 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.