wp_media BackWPup Plugin up to 5.6.6 on WordPress REST Endpoint getblock str_replace block_name path traversal

Summaryinfo

A vulnerability labeled as critical has been found in wp_media BackWPup Plugin up to 5.6.6 on WordPress. The affected element is the function str_replace of the file /wp-json/backwpup/v1/getblock of the component REST Endpoint. Executing a manipulation of the argument block_name can lead to path traversal. This vulnerability is registered as CVE-2026-6227. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in wp_media BackWPup Plugin up to 5.6.6 on WordPress. This vulnerability affects the function str_replace of the file /wp-json/backwpup/v1/getblock of the component REST Endpoint. The manipulation of the argument block_name with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/backwpup/v1/getblock` REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive `str_replace()` sanitization of path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to include arbitrary PHP files on the server via crafted traversal sequences (e.g., `....//`), which can be leveraged to read sensitive files such as `wp-config.php` or achieve remote code execution in certain configurations. Administrators have the ability to grant individual users permission to handle backups, which may then allow lower-level users to exploit this vulnerability.

The weakness was published by Joao Pedro Ventura Alves. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-6227 since 04/13/2026. The exploitation appears to be easy. The attack can be initiated remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 5.6.5 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wp_media

Name

• BackWPup Plugin

Version

• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4
• 5.6.5
• 5.6.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion