CVE-2026-18386: WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backupfile' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The basename() normalization present in the handler only executes when the traversed target path does not exist, providing no protection against reads of existing files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP BackItUp Community Editionto a version that resolves this vulnerability.Fixed in 2.1.0Patch WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter - Compensating control
Restrict access to the WordPress administration area to trusted users (administrator-level access and above is explicitly required to exploit the 'backup_file' directory traversal).
- Operational
Rotate any secrets/credentials that may have been exposed by arbitrary file reads before re-enabling or reusing affected environments after remediation.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with administrator-level privileges or higher. Remote unauthenticated users and lower-privileged accounts are not identified as able to exploit it.
Which installations are affected?
WP BackItUp Community Edition versions up to and including 2.1.0 are affected. The issue is in handling of the backup_file parameter.
What can an attacker obtain through exploitation?
An administrator-level attacker can read arbitrary existing files on the server. Those files may contain sensitive information.
Does the existing basename() handling prevent exploitation?
No. The basename() normalization runs only when the traversed target path does not exist, so it does not protect reads of existing files.