fahadmahmood Keep Backup Daily Plugin up to 2.1.1 on WordPress AJAX Action sanitize_text_field kbd_path path traversal

Summaryinfo

A vulnerability classified as critical was found in fahadmahmood Keep Backup Daily Plugin up to 2.1.1 on WordPress. This impacts the function sanitize_text_field of the component AJAX Action Handler. Executing a manipulation of the argument kbd_path can lead to path traversal. This vulnerability is registered as CVE-2026-3339. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in fahadmahmood Keep Backup Daily Plugin up to 2.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function sanitize_text_field of the component AJAX Action Handler. The manipulation of the argument kbd_path with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.

The weakness was published by san6051. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-3339 since 02/27/2026. The exploitation appears to be easy. The attack can be initiated remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 2.1.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-13897). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Backup Software

Vendor

• fahadmahmood

Name

• Keep Backup Daily Plugin

Version

• 2.1.0
• 2.1.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion