BackWPup CVE-2026-86827

Exploitation requires only that the BackWPup plugin (version 3.3 up to but not including 5.7.7) be installed and active, and that at least one backup job already be configured - the attacker cannot create jobs, only trigger existing ones. No authentication, user interaction, or non-default configuration is needed: the cron-triggered backup execution handler is reachable by unauthenticated attackers (AV:N/PR:N/UI:N) and does not verify that the request originates from WordPress's internal scheduled-event dispatch. The principal limiting factor is impact scope - the attacker can force any pre-existing backup job to run immediately regardless of its trigger type or schedule, but gains no data access and cannot define new jobs, so harm is confined to unscheduled job execution and the resulting resource consumption.

This is a genuine but moderate-severity issue, not a top-priority emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3, MEDIUM) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated flaw (PR:N) with no user interaction, but with only limited integrity impact (I:L) and explicitly no confidentiality or availability impact rated. The CWE-862 (Missing Authorization) classification matches the root cause - the cron handler fails to confirm the request originates from WordPress's internal scheduled-event dispatch. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation probability and the SSVC exploitation/automatable/technical-impact dimensions cannot be computed. The absence of KEV/EPSS is not evidence of low risk, merely missing signal. The practical ceiling on risk is the low impact: an attacker can force already-configured backup jobs to run on demand, but cannot create jobs, exfiltrate data, or crash the site per the rated vector - the realistic harm is unscheduled resource consumption (CPU/IO/storage, potential denial-of-service pressure despite A:N) and disruption of backup cadence. Weighing the signals together: wide plugin deployment and trivial unauthenticated reachability raise attacker opportunity, but the capped integrity-only impact keeps this a medium-priority patch rather than a critical one.

An attacker who knows a site runs BackWPup sends an unauthenticated HTTP request directly to the plugin's cron-triggered backup execution endpoint, which fails to verify the call came from WordPress's internal wp-cron dispatch. The attacker repeatedly triggers an existing backup job to run immediately, consuming server CPU, I/O, and storage out of schedule. No public exploit code was identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication (PR:N) make a working request straightforward to craft.