BackupSheep Backup Plugin EUVD-2026-90507

Exploitable when the BackupSheep WordPress Backup Plugin (through version 1.8) is installed and its integration key is left unset or blank - the plugin treats an empty key as valid, so any default/unconfigured installation is vulnerable to unauthenticated remote attack against standard HTTP(S) endpoints. No authentication, user interaction, or special platform is required (AV:N/AC:L/PR:N/UI:N). The principal limiting factors are deployment-related rather than technical: the plugin was closed on WordPress.org in July 2024 and has no patched release, so exposure is confined to sites that still have this abandoned plugin active; sites that configured a non-blank integration key may not be exploitable via the blank-key path. Mitigation is removal of the plugin, as no fix exists.

This is a genuine high-priority issue, not a CVSS-inflation artifact. The vendor/WPScan CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a broken-authentication flaw where an unset or blank integration key is treated as valid, giving unauthenticated network attackers full backup creation/download (exposing the database with user password hashes) plus arbitrary file deletion - a credible path to full site takeover. All CVSS signals align with the description: no authentication (PR:N), no user interaction (UI:N), low complexity (AC:L), and full triple-impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk rating rests on the trivial exploitability and catastrophic impact rather than observed activity. The most important mitigating factor is NOT in the CVSS vector: the plugin was closed on WordPress.org in July 2024 with no fixed version, so the realistic exposure is limited to the shrinking set of sites still running this abandoned plugin. S:C (scope change) is defensible because impact extends from the plugin to the whole WordPress install and underlying server filesystem, though an S:U reading (~9.8) is also arguable; either way severity is critical.

An unauthenticated attacker locates a site running BackupSheep (through 1.8) where the integration key is unset or blank - the default/unconfigured state - and sends requests to the plugin's endpoints with no valid key, which the plugin accepts. The attacker triggers a full site backup, downloads it to harvest the database (including user password hashes for offline cracking), and/or invokes the arbitrary file-deletion path to destroy site files. No public POC is referenced in the input, but the attack requires no authentication, no user interaction, and low complexity.