BackWPup EUVD-2026-94749

Exploitation requires (1) an authenticated high-privileged user (PR:H - typically a WordPress administrator with backup/restore capability), (2) the plugin performing a restore while its FALLBACK archive library is in use rather than the primary extractor, and (3) a maliciously crafted backup archive containing path-traversal entries supplied to that restore operation. These combine into AC:H: the non-default fallback-library code path and the attacker-controlled archive are the gating conditions. Limiting factors that reduce real-world risk: the required high privilege level (an admin can frequently already write files by other means), the dependence on the fallback (not primary) archive path, and the lack of any user-interaction-free or unauthenticated route.

This is a moderate-severity path traversal (CWE-22) with a confirmed vendor patch (BackWPup 5.7.7) and a CVSS 3.1 base score of 6.6. The provided vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) is the dominant signal and it tempers the raw impact considerably: although the attack vector is network-based and the impact triple is High/High/High (potential RCE), successful exploitation requires PR:H (high-privileged / authenticated admin-level user) AND AC:H (a non-trivial precondition - the fallback archive library must be the one in use during a restore, plus a maliciously crafted archive). No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied, so there is no evidence of active exploitation or automatable mass-exploitation; per the input this is 'no public exploit identified at time of analysis.' The practical risk is low-to-moderate: an attacker who is already a high-privileged WordPress user can escalate to code execution, but that actor can often already run plugins/themes or edit files, so the real-world severity gain depends heavily on the site's privilege model (e.g., multisite or delegated admin roles where restore capability is granted without full file-write trust). Treat this as a defense-in-depth patch priority rather than an emergency, absent any exploitation signal.

An authenticated high-privileged WordPress user (or an attacker who has compromised such an account) initiates a backup restore using a crafted archive while the plugin's fallback archive library is active; the archive contains entries with traversal sequences in their paths. During extraction the plugin writes those files outside the intended restore directory - for example dropping a PHP file into the webroot - which can then be requested to achieve remote code execution. No public exploit code is referenced in the available data.