EUVD-2026-22201
GHSA-6gj4-hcqg-pjc8
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive str_replace() sanitization of path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to include arbitrary PHP files on the server via crafted traversal sequences (e.g., ....//), which can be leveraged to read sensitive files such as wp-config.php or achieve remote code execution in certain configurations. Administrators have the ability to grant individual users permission to handle backups, which may then allow lower-level users to exploit this vulnerability.
AnalysisAI
Local file inclusion in BackWPup WordPress plugin versions ≤5.6.6 allows authenticated administrators to read sensitive configuration files or achieve remote code execution via path traversal bypass in the /wp-json/backwpup/v1/getblock REST endpoint. The vulnerability stems from insufficient sanitization using non-recursive str_replace(), enabling crafted sequences like ....// to bypass filtering. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit all BackWPup plugin installations and document current versions deployed across WordPress instances. Within 7 days: Restrict REST API access to BackWPup endpoints via web application firewall rules or .htaccess if patch remains unavailable; disable backup delegation to non-administrative users until patched. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today