CVE-2026-86826 in BackWPup Plugin
Summary
by MITRE • 10/08/2026
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in BackWPup versions prior to 5.7.7 represents a critical failure in access control mechanisms within WordPress plugin architecture, specifically concerning file system permissions and web server configuration handling. The core technical flaw lies in the improper restriction of web access to the temporary working directory utilized during backup restoration processes. When an administrator initiates a restore operation that is interrupted or fails before completion, residual files including database dumps containing sensitive credentials and site files holding secret keys are left behind in this specific directory. Under normal circumstances with Apache-based hosting environments utilizing .htaccess rules, these directories might be protected from direct web access through deny directives configured by the plugin or server defaults. However, the vulnerability exploits scenarios where the underlying web server does not honor standard .htaccess configurations, most notably NGINX servers which rely on explicit configuration blocks rather than distributed configuration files for access control.
This architectural mismatch creates a significant security gap that allows unauthenticated attackers to enumerate and download these sensitive artifacts directly via HTTP requests. The operational impact is severe as it leads to the exposure of comprehensive site data including full database dumps, PHP source code, and critical authentication secrets such as WordPress salts and keys. These credentials are essential for maintaining session integrity and encrypting user data; their compromise enables attackers to perform account takeover attacks, forge administrative sessions, or decrypt stored sensitive information within the database. Furthermore, access to the raw site files facilitates further reconnaissance and potentially aids in crafting targeted exploits against other vulnerabilities present in the application codebase.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized entities gaining access to restricted resources due to misconfigured permissions or inadequate enforcement of security policies. It also relates closely to CWE-538 Insertion of Sensitive Information into Log File and CWE-798 Use of Hard-coded Credentials if the exposed files contain hardcoded secrets, though primarily it is an issue of information disclosure through improper file system access controls. In terms of the MITRE ATT&CK framework, this vulnerability supports reconnaissance activities by allowing attackers to gather intelligence about the target environment's structure and credentials without authentication, fitting into techniques associated with Collection and Credential Access phases where sensitive data is exfiltrated from compromised systems or misconfigured storage locations.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade BackWPup to version 5.7.7 or later, which implements stricter access controls for working directories regardless of the web server type. For environments unable to update immediately due to compatibility constraints, administrators should manually ensure that backup temporary directories are located outside the public document root or configured with explicit deny rules in NGINX configuration files rather than relying on .htaccess directives. Additionally, implementing strict file permissions such as 750 for working directories and ensuring they are not world-readable can provide an additional layer of defense. Regular auditing of plugin configurations against web server capabilities is essential to prevent similar misconfigurations that exploit differences in how various servers interpret security rules.