Skip to content
OpenAdvisories

Product · WP Media

BackWPup – WordPress Backup & Restore Plugin

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.2
    CVE-2026-6227 Public exploit

    BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

    The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/backwpup/v1/getblock` REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive `str_replace()` sanitization of path…

    WP Media BackWPup – WordPress Backup & Restore Plugin Web / CMS