BackWPup CVE-2026-86826

Exploitation requires a specific combination: (1) the site must run a webserver that does not enforce .htaccess access rules - explicitly NGINX - so the plugin's directory-level restriction is bypassed, and (2) a backup restore operation must have been interrupted, leaving a complete backup archive in the plugin's working directory. On Apache or other servers honouring .htaccess, access is blocked, and if no interrupted restore has occurred there is no archive to retrieve. These environmental and timing dependencies (reflected in AC:H) significantly limit real-world exploitability despite the unauthenticated network vector; no user interaction or authentication is needed once the conditions hold.

This is a genuine but conditional information-disclosure flaw, not a top-tier emergency. The CVSS vector (AV:N/AC:H/PR:N/UI:N, C:H/I:N/A:N) correctly reflects a high-confidentiality impact reachable remotely by unauthenticated attackers, but with high attack complexity because exploitation depends on two conditions outside the attacker's control: the webserver must not honour .htaccess (e.g. NGINX), and a backup restore must have been interrupted, leaving the full archive in the working directory. The 5.9 (Medium) base score is consistent with that trade-off between broad reachability and dependency on a transient, environment-specific state. No EPSS score was supplied, the CVE is not on CISA KEV, and no POC was indicated, so there is no evidence of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis.' The impact if successful is severe (database dump, site files, credentials, and secret keys), making this a prioritize-if-you-run-NGINX issue rather than a universal drop-everything patch. Missing signals: EPSS, POC status, and any exploitation telemetry are absent and should be treated as unknown rather than low.

An attacker who knows a WordPress site runs BackWPup behind NGINX periodically requests the plugin's backup working-directory path. If an administrator's restore operation was interrupted and left a backup archive behind, the attacker downloads it directly over HTTP without authentication, obtaining the database dump, site files, credentials, and secret keys. No public exploit code is identified at time of analysis, but the attack requires only crafted HTTP GET requests.