CVE-2026-86827: BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BackWPupto a version that resolves this vulnerability.Fixed in 5.7.7
Event History
Frequently Asked Questions
Which installations are affected?
BackWPup versions before 5.7.7 are affected if they have existing backup jobs that can be invoked through the plugin’s cron-triggered execution handler.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They can cause an existing backup job to run immediately by sending a request to the affected cron execution handler.
Does the job need to be scheduled for an attacker to run it?
No. The issue allows an attacker to force an existing backup job to execute regardless of its configured trigger type or schedule.
What is the immediate remediation?
Update BackWPup to version 5.7.7 or later, which is outside the affected version range.