CVE-2026-86828 - Vulnerability Details - OpenCVE

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Wordpress-extensions	Backwpup

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/be8c0eab-1874-4490-b94e-394f62a522f3/

History

Fri, 09 Oct 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wordpress-extensions Wordpress-extensions backwpup
Vendors & Products		Wordpress-extensions Wordpress-extensions backwpup

Thu, 08 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-73

Thu, 08 Oct 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 08 Oct 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-22 CWE-73

Thu, 08 Oct 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
Title		BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
References		https://wpscan.com/vulnerability/be8c0eab-1874-4490-b94e-394f62a522f3/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-10-08T06:00:08.185Z

Updated: 2026-10-08T10:59:18.107Z

Reserved: 2026-09-08T14:26:00.880Z

Link: CVE-2026-86828

Vulnrichment

Updated: 2026-10-08T10:52:53.705Z

NVD

Status : Deferred

Published: 2026-10-08T06:16:45.287

Modified: 2026-10-08T20:51:18.123

Link: CVE-2026-86828

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86828", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-08T14:26:00.880Z", "datePublished": "2026-10-08T06:00:08.185Z", "dateUpdated": "2026-10-08T10:59:18.107Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-08T06:00:08.185Z"}, "title": "BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback", "problemTypes": [{"descriptions": [{"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "BackWPup", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "5.7.7"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution."}], "references": [{"url": "https://wpscan.com/vulnerability/be8c0eab-1874-4490-b94e-394f62a522f3/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Bhaveshkumar Parmar", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-86828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T10:55:24.125123Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T10:59:18.107Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86828", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-08T14:26:00.880Z", "datePublished": "2026-10-08T06:00:08.185Z", "dateUpdated": "2026-10-08T10:59:18.107Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-08T06:00:08.185Z"}, "title": "BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback", "problemTypes": [{"descriptions": [{"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "BackWPup", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "5.7.7"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution."}], "references": [{"url": "https://wpscan.com/vulnerability/be8c0eab-1874-4490-b94e-394f62a522f3/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Bhaveshkumar Parmar", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-86828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-08T10:55:24.125123Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T10:52:53.705Z"}}]}}