What is the CVSS score of CVE-2026-6227?

CVE-2026-6227 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-6227?

BackWPup WordPress plugin versions 5.6.6 and earlier contain a local file inclusion vulnerability in the REST API that allows authenticated administrators to read sensitive files or execute arbitrary…

How to fix or mitigate CVE-2026-6227?

Within 24 hours: Audit all BackWPup plugin installations and document current versions deployed across WordPress instances. Within 7 days: Restrict REST API access to BackWPup endpoints via web application firewall rules or .htaccess if patch remains unavailable; disable backup delegation to non-administrative users until patched. Within 30 days: Apply vendor patch immediately upon release to all affected BackWPup installations (currently ≤5.6.6); monitor BackWPup security advisories at https://wordpress.org/plugins/backwpup/ for patch availability.

PHP CVE-2026-6227

EUVD-2026-22201 HIGH

Path Traversal (CWE-22)

2026-04-14 Wordfence

GHSA-6gj4-hcqg-pjc8

PHP Path Traversal WordPress RCE

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 02:55 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 02:45 euvd

EUVD-2026-22201

Analysis Generated

Apr 14, 2026 - 02:45 vuln.today

CVE Published

Apr 14, 2026 - 02:25 nvd

HIGH 7.2

DescriptionCVE.org

The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive str_replace() sanitization of path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to include arbitrary PHP files on the server via crafted traversal sequences (e.g., ....//), which can be leveraged to read sensitive files such as wp-config.php or achieve remote code execution in certain configurations. Administrators have the ability to grant individual users permission to handle backups, which may then allow lower-level users to exploit this vulnerability.

AnalysisAI

Local file inclusion in BackWPup WordPress plugin versions ≤5.6.6 allows authenticated administrators to read sensitive configuration files or achieve remote code execution via path traversal bypass in the /wp-json/backwpup/v1/getblock REST endpoint. The vulnerability stems from insufficient sanitization using non-recursive str_replace(), enabling crafted sequences like ....// to bypass filtering. While requiring high privileges (PR:H), the plugin's permission delegation feature allows administrators to grant backup management rights to lower-privileged users, expanding the attack surface. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CVSS 7.2 reflects high confidentiality, integrity, and availability impact.

Technical ContextAI

The vulnerability affects the BackWPup WordPress Backup & Restore Plugin (cpe:2.3:a:wp_media:backwpup_-_wordpress_backup_&_restore_plugin) through version 5.6.6. The flaw resides in the REST API endpoint handler at src/Frontend/API/Rest.php (line 52) and path sanitization logic in inc/Utils/BackWPupHelpers.php (lines 23, 40). The root cause (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) occurs because the sanitization function uses str_replace() in a non-recursive manner to remove directory traversal sequences. Attackers can bypass this by using double-encoded or nested sequences such as ....// which, after single-pass sanitization removing ../, resolve back to valid traversal patterns ../. This allows arbitrary file path construction in the block_name parameter, enabling PHP file inclusion attacks against the WordPress installation's filesystem. The REST API architecture in WordPress exposes this endpoint to authenticated HTTP requests without sufficient input validation depth.

RemediationAI

Upgrade to BackWPup plugin version 5.6.7 or later, which addresses the path traversal vulnerability through improved recursive sanitization logic as documented in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3490642%40backwpup%2Ftrunk&old=3475739%40backwpup%2Ftrunk&sfp_email=&sfph_mail=#file26. The patch modifies inc/Utils/BackWPupHelpers.php to implement recursive or more robust path traversal filtering that cannot be bypassed with nested sequences. WordPress administrators should update via the WordPress admin dashboard under Plugins > Updates, or manually download from the official WordPress plugin repository. As an interim mitigation if patching is delayed, restrict administrator-level access and revoke any delegated backup permissions granted to lower-privileged users through the plugin's permission system. Review WordPress user roles and ensure the principle of least privilege is enforced. Conduct post-patch review of server logs for suspicious REST API requests to /wp-json/backwpup/v1/getblock with traversal patterns to identify potential prior exploitation attempts.