CVE-2026-86826

5.9 Moyenne

Publiée le 08/10/2026 à 08:16 · Modifiée le 08/10/2026 à 22:51 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.

Traduire en français

Produits concernés

Unknown BackWPup

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.9 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-200

Références

https://wpscan.com/vulnerability/ee9f0772-ac6f-4e2d-a2c0-cc8892291932/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories