CVE-2026-86828 in BackWPup Plugin
Summary
by MITRE • 10/08/2026
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in BackWPup versions prior to 5.7.7 represents a critical path traversal and arbitrary file write flaw within the WordPress plugin ecosystem. This security issue specifically affects the archive extraction mechanism when the fallback library is utilized during backup restoration processes. The core technical deficiency lies in the insufficient validation of destination paths for files being extracted from archived backups. When an administrator initiates a restore operation, the software fails to properly sanitize or canonicalize file paths contained within the archive structure. This oversight allows specially crafted archives containing entries with relative path components such as dot-dot-slash sequences to escape the designated backup directory and write content into arbitrary locations on the server's filesystem.
From a technical perspective, this flaw aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory. The vulnerability exploits the lack of strict boundary enforcement during the decompression phase. By manipulating archive entries to include parent directory references, an attacker can direct file writes outside the sandboxed backup folder. This behavior is particularly dangerous because it bypasses standard WordPress security models that typically restrict write access to specific directories like wp-content/uploads or plugin-specific folders. The reliance on a fallback library suggests that this issue may persist across different PHP archive handling implementations if not explicitly patched, indicating a systemic design flaw in how the restore function handles untrusted input from backup files.
The operational impact of this vulnerability is severe due to its potential for Remote Code Execution. Although the exploit requires high-privileged user access, such as an Administrator role within WordPress, attackers who compromise administrative credentials can leverage this flaw to achieve full server control. By writing a PHP web shell or other malicious script into a publicly accessible directory with appropriate execution permissions, the attacker gains the ability to execute arbitrary code on the host system. This effectively transforms a local file write vulnerability into a remote exploitation vector, allowing for complete takeover of the WordPress installation and potentially lateral movement within the underlying server infrastructure if further privileges are escalated.
This attack scenario is consistent with MITRE ATT&CK techniques related to Initial Access via Valid Accounts and Execution via Web Shell. The attacker utilizes legitimate administrative credentials to upload or restore maliciously crafted backups, thereby bypassing network-level defenses that typically block direct file uploads of executable content. Once the web shell is placed in a writable directory, it serves as a persistent backdoor for ongoing access and further exploitation activities.
Mitigation strategies must prioritize immediate software updates. Administrators running BackWPup should upgrade to version 5.7.7 or later where this path validation logic has been corrected. In environments where upgrading is not immediately feasible, temporary mitigations include restricting file upload permissions for the WordPress directories, ensuring that executable scripts cannot be written directly into web-accessible paths without proper isolation. Additionally, implementing strict input validation on any custom code interacting with backup archives and monitoring server logs for unusual write operations outside standard plugin directories can help detect attempted exploitation. Regular auditing of installed plugins and adherence to least-privilege principles remain essential components of a robust WordPress security posture.