EUVD-2026-13897
GHSA-fxxv-5hv8-hp3c
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2021 - Broken Access Control
ASVS 5.0
V4 - Access Control Authorization enforcement, RBAC validation
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The risk profile presents a nuanced picture despite the low CVSS v3.1 score of 2.7. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) accurately reflects that exploitation requires Administrator-level privileges (PR:H) with no user interaction, a low attack complexity, and limited impact (confidentiality only, no integrity or availability impact). However, real-world risk depends on WordPress deployment context: in single-admin installations or where admin credentials are tightly controlled, this is a low-priority issue; in multi-user WordPress networks or shared hosting environments where administrator accounts are compromised, it becomes a meaningful information disclosure channel. The vulnerability is not listed as actively exploited in CISA's KEV catalog, and no public proof-of-concept is referenced in available sources, keeping opportunistic exploitation low. The technical barrier is minimal (simple HTTP parameter manipulation), and the attack is automatable, but the privilege requirement significantly constrains the threat actor pool. From an SSVC perspective, this rates as low priority unless deployed in high-trust, multi-tenant environments. |
| Exploit ScenarioDerived | A WordPress administrator account is compromised via weak password or phishing. The attacker, now authenticated with admin privileges, uses the browser console or a simple curl request to send an AJAX POST to the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
The Keep Backup Daily WordPress plugin versions up to 2.1.1 contain a limited path traversal vulnerability in the kbd_open_upload_dir AJAX action that allows authenticated administrators to enumerate arbitrary directories on the server. An attacker with Administrator-level access can exploit insufficient sanitization of the kbd_path parameter (using only sanitize_text_field() which does not prevent path traversal sequences) to list directory contents outside the intended uploads directory. While the CVSS score of 2.7 is low and exploitation requires high-privilege Administrator access, the vulnerability represents a real information disclosure risk in multi-user WordPress environments or where administrator accounts are compromised.
RemediationAI
Update Keep Backup Daily to a version newer than 2.1.1 immediately; consult the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset for the patched version (referenced changeset 3481587 indicates a fix has been committed). The patch should implement proper path validation using functions like wp_normalize_path() combined with realpath() verification to ensure the resolved path remains within the intended uploads directory. For users unable to patch immediately, restrict Administrator role assignment to only trusted users, monitor AJAX requests to the kbd_open_upload_dir action for suspicious kbd_path parameters containing traversal sequences, and consider disabling the plugin if its backup functionality is not actively required. Implement file integrity monitoring on sensitive directories (/wp-config.php, configuration files) to detect unauthorized enumeration attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from a path traversal weakness (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in the Keep Backup Daily plugin (CPE: cpe:2.3:a:fahadmahmood:keep_backup_daily), which is a WordPress backup utility. The vulnerable code exists in the AJAX handler kbd_open_upload_dir within inc/functions.php (referenced at lines 855 and 871 in version 2.1.1). The root cause is reliance on sanitize_text_field(), a WordPress function designed to remove HTML and script content but which explicitly does not strip path traversal sequences such as ../ or ..\. This allows an attacker to construct paths like ../../etc/ to traverse outside the intended backup upload directory and enumerate arbitrary filesystem locations. The plugin's backup functionality makes directory listing particularly sensitive, as it could expose configuration files, source code, or other sensitive data.
Know when Keep Backup Daily gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the kbd_open_upload_dir AJAX action. This is due to insufficient validation of the kbd_path parameter, which is only sanitized with sanitize_text_field() - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.
Executive ViewAI
CVE-2026-3339 is a low-severity vulnerability in for WordPress is vulnerable to Limited Path Traversal in all involving path traversal (CVSS 2.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard path traversal mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Keep Backup Daily
View allUnauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in vers
The Keep Backup Daily WordPress plugin versions up to 2.1.2 contain a Stored Cross-Site Scripting (XSS) vulnerability in
Exploit-DB