CVE-2026-86828: BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BackWPupto a version that resolves this vulnerability.Fixed in 5.7.7
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs high-privileged access to the WordPress site, such as an administrative-level account. The CVSS vector also indicates that no user interaction is required once that access is obtained.
Which deployments are affected?
BackWPup versions earlier than 5.7.7 are affected. Exploitation also depends on the plugin using its fallback archive library during a backup restore.
What is the impact of successful exploitation?
A high-privileged user can write extracted backup files outside the intended restore directory through path traversal. This can potentially be escalated to remote code execution, with high confidentiality, integrity, and availability impact indicated by the CVSS vector.
What should be prioritized for mitigation?
Update BackWPup to version 5.7.7 or later. Until updating is possible, restrict high-privileged WordPress access and avoid backup restore operations that use the fallback archive library.