BackWPup – WordPress Backup & Restore Plugin <= 5.7.6 - Missing Authorization to Unauthenticated Backup Job Execution
- ID
- WPSEC-2026-0501
- Plugin
- BackWPup – WordPress Backup & Restore Plugin (backwpup)
- Affected
- from 3.3 before 5.7.7
- Remediation
- Update to 5.7.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-07
- Attack surface
- BackWPup – WordPress Backup & Restore Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The BackWPup plugin for WordPress is vulnerable to unauthorized backup job execution in versions 3.3 up to, and including, 5.7.6. This is due to the BackWPup_Cron::cron_active() function accepting the internal 'cronrun' run type from the wp-cron.php?backwpup_run= request parameter and expecting an empty nonce for it, so the check passes when no nonce is supplied. This makes it possible for unauthenticated attackers to start any backup job by its numeric ID, including jobs that are disabled or that are meant to be started only through the key-protected external link. This consumes server resources and sends unwanted backups to the job's configured destinations. Because every run applies the job's backup retention limit, repeated runs can also cause older backups to be deleted.
References
- https://wpsec.com/vuln/WPSEC-2026-0501/
- https://plugins.svn.wordpress.org/backwpup/tags/5.7.7/
- https://wordpress.org/plugins/backwpup/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS