CVE-2026-104307: BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error

Q: Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can trigger the affected AJAX action. The issue does not require administrative privileges.

Q: What can an attacker do through the vulnerable action?

An attacker can delete BackUpWordPress backup protection and working files from the plugin's backup directory. This can remove download protection from stored backups and interrupt backups that are in progress.

Q: What conditions are required for exploitation?

The attacker needs a valid authenticated account on the WordPress site. The vulnerable AJAX action lacks both capability and nonce checks.

Q: Which installations are affected?

BackUpWordPress versions before 3.15 are affected. The provided information does not identify any configuration prerequisite beyond having the vulnerable plugin installed.

Published Nov 8, 2026

Updated

The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade BackUpWordPress to a version that resolves this vulnerability.
Fixed in 3.15

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can trigger the affected AJAX action. The issue does not require administrative privileges.

What can an attacker do through the vulnerable action?

An attacker can delete BackUpWordPress backup protection and working files from the plugin's backup directory. This can remove download protection from stored backups and interrupt backups that are in progress.

What conditions are required for exploitation?

The attacker needs a valid authenticated account on the WordPress site. The vulnerable AJAX action lacks both capability and nonce checks.

Which installations are affected?

BackUpWordPress versions before 3.15 are affected. The provided information does not identify any configuration prerequisite beyond having the vulnerable plugin installed.

CVE-2026-104307: BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do through the vulnerable action?

What conditions are required for exploitation?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do through the vulnerable action?

What conditions are required for exploitation?

Which installations are affected?