What is the CVSS score of EUVD-2026-13897?

EUVD-2026-13897 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-13897?

During next maintenance window: Apply vendor patches when convenient. Verify path traversal controls are in place.

WordPress EUVD-2026-13897

Q: Which versions of WordPress are affected by EUVD-2026-13897?

CVE-2026-3339 is a low-severity vulnerability in for WordPress is vulnerable to Limited Path Traversal in all involving path traversal (CVSS 2.7).

| CVE-2026-3339 LOW

Path Traversal (CWE-22)

2026-03-20 Wordfence

GHSA-fxxv-5hv8-hp3c

GHSA-vfx2-hv2g-xj5f

WordPress Path Traversal

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:46 euvd

EUVD-2026-13897

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:25 nvd

LOW 2.7

DescriptionCVE.org

The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the kbd_open_upload_dir AJAX action. This is due to insufficient validation of the kbd_path parameter, which is only sanitized with sanitize_text_field() - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.

AnalysisAI

The Keep Backup Daily WordPress plugin versions up to 2.1.1 contain a limited path traversal vulnerability in the kbd_open_upload_dir AJAX action that allows authenticated administrators to enumerate arbitrary directories on the server. An attacker with Administrator-level access can exploit insufficient sanitization of the kbd_path parameter (using only sanitize_text_field() which does not prevent path traversal sequences) to list directory contents outside the intended uploads directory. While the CVSS score of 2.7 is low and exploitation requires high-privilege Administrator access, the vulnerability represents a real information disclosure risk in multi-user WordPress environments or where administrator accounts are compromised.

Technical ContextAI

The vulnerability stems from a path traversal weakness (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in the Keep Backup Daily plugin (CPE: cpe:2.3:a:fahadmahmood:keep_backup_daily), which is a WordPress backup utility. The vulnerable code exists in the AJAX handler kbd_open_upload_dir within inc/functions.php (referenced at lines 855 and 871 in version 2.1.1). The root cause is reliance on sanitize_text_field(), a WordPress function designed to remove HTML and script content but which explicitly does not strip path traversal sequences such as ../ or ..\. This allows an attacker to construct paths like ../../etc/ to traverse outside the intended backup upload directory and enumerate arbitrary filesystem locations. The plugin's backup functionality makes directory listing particularly sensitive, as it could expose configuration files, source code, or other sensitive data.

RemediationAI

Update Keep Backup Daily to a version newer than 2.1.1 immediately; consult the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset for the patched version (referenced changeset 3481587 indicates a fix has been committed). The patch should implement proper path validation using functions like wp_normalize_path() combined with realpath() verification to ensure the resolved path remains within the intended uploads directory. For users unable to patch immediately, restrict Administrator role assignment to only trusted users, monitor AJAX requests to the kbd_open_upload_dir action for suspicious kbd_path parameters containing traversal sequences, and consider disabling the plugin if its backup functionality is not actively required. Implement file integrity monitoring on sensitive directories (/wp-config.php, configuration files) to detect unauthorized enumeration attempts.