CVE-2026-6227

Summary

The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive str_replace() sanitization of path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to include arbitrary PHP files on the server via crafted traversal sequences (e.g., ....//), which can be leveraged to read sensitive files such as wp-config.php or achieve remote code execution in certain configurations. Administrators have the ability to grant individual users permission to handle backups, which may then allow lower-level users to exploit this vulnerability.

Affected Software

VendorProductVersion RangeStatus
wp_mediaBackWPup – WordPress Backup & Restore Plugin0 <= 5.6.6affected

Weaknesses

  • CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References