CVE-2026-86826: BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BackWPupto a version that resolves this vulnerability.Fixed in 5.7.7
Event History
Frequently Asked Questions
Which deployments are exposed?
BackWPup installations earlier than 5.7.7 are exposed when they run on a web server that does not honor .htaccess rules, such as NGINX. Exposure also depends on an interrupted backup restore leaving an archive in the restore working directory.
What does an attacker need to exploit this?
No authentication or user interaction is required. An attacker needs network access to the affected site and the presence of a backup archive left behind by an interrupted restore.
What information could be disclosed?
An attacker may download the full backup archive, including the database dump and site files. This can expose credentials and secret keys contained in those backups.
How can I tell whether data may already be exposed?
Check whether a restore was interrupted and left a backup archive in BackWPup's restore working directory. On affected NGINX or other .htaccess-noncompliant web server deployments, such an archive may have been web-accessible.
What should be done if immediate upgrading is not possible?
Remove any backup archives left in the restore working directory and prevent web access to that directory at the web-server configuration level. Treat credentials and secret keys contained in any potentially exposed backup as compromised.