Skip to content
OpenAdvisories

Product · WP Media

BackWPup – WordPress Backup & Restore Plugin

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.2
    CVE-2026-6227 Public exploit

    BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

    The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/backwpup/v1/getblock` REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive `str_replace()` sanitization of path…

    WP Media BackWPup – WordPress Backup & Restore Plugin Web / CMS
  • High 7.2
    CVE-2025-15041

    BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update

    The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the save_site_option() function in all versions up to, and incl…

    WP Media BackWPup – WordPress Backup & Restore Plugin Web / CMS
  • High 8.7
    CVE-2023-5504

    BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

    The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by …

    WP Media BackWPup – WordPress Backup & Restore Plugin Web / CMS