CVE-2026-86815 BackWPup CVE debrief

Who should care

Defenders responsible for WordPress installations with the BackWPup plugin should assess exposure and prioritize verification and remediation due to the potential for unauthorized access and data breaches. They should verify plugin versions, restrict access to sensitive routes, and monitor for suspicious activities.

Why it matters

Defenders should care about CVE-2026-86815 because it allows users with limited roles to create and run backup jobs and exfiltrate full database backups, potentially leading to unauthorized access and data breaches.

• Potential exfiltration of full database backups
• Unauthorized creation and execution of backup jobs
• Elevation of privileges for users with limited roles

Technical summary

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination. This issue arises from inadequate access controls on REST API routes, potentially leading to unauthorized access and data breaches.

Defensive priority

Defenders should prioritize verifying exposure of BackWPup plugin versions before 5.7.5 and restrict access to sensitive REST API routes.

Recommended defensive actions

• Verify BackWPup plugin version and update to 5.7.5 or later
• Restrict access to sensitive REST API routes
• Monitor for suspicious backup job creation and execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the BackWPup WordPress plugin before 5.7.5. Defenders should verify plugin versions and assess exposure. Evidence is limited to CVE and NVD details, with no additional information available for further verification. Official records indicate a vulnerability exists, allowing users with limited roles to create and run backup jobs and exfiltrate full database backups.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.