{
 "id": "WPSEC-2026-0501",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0501/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0501/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0501/index.md",
 "title": "BackWPup – WordPress Backup & Restore Plugin <= 5.7.6 - Missing Authorization to Unauthenticated Backup Job Execution",
 "description": "The BackWPup plugin for WordPress is vulnerable to unauthorized backup job execution in versions 3.3 up to, and including, 5.7.6. This is due to the BackWPup_Cron::cron_active() function accepting the internal 'cronrun' run type from the wp-cron.php?backwpup_run= request parameter and expecting an empty nonce for it, so the check passes when no nonce is supplied. This makes it possible for unauthenticated attackers to start any backup job by its numeric ID, including jobs that are disabled or that are meant to be started only through the key-protected external link. This consumes server resources and sends unwanted backups to the job's configured destinations. Because every run applies the job's backup retention limit, repeated runs can also cause older backups to be deleted.",
 "plugin": {
  "slug": "backwpup",
  "name": "BackWPup – WordPress Backup & Restore Plugin",
  "full_name": "BackWPup – WordPress Backup & Restore Plugin",
  "wordpress_org": "https://wordpress.org/plugins/backwpup/",
  "advisories_url": "https://wpsec.com/vuln/plugin/backwpup/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/backwpup"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.3",
    "from_inclusive": true,
    "to": "5.7.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.3 before 5.7.7"
  ]
 },
 "introduced_in": "3.3",
 "fixed_in": "5.7.7",
 "remediation": "Update to 5.7.7 or later.",
 "fix_released": "2026-10-05T10:14:24+00:00",
 "published": "2026-10-07T11:46:41+00:00",
 "updated": "2026-10-07T10:53:23.064784+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0501/",
  "https://plugins.svn.wordpress.org/backwpup/tags/5.7.7/",
  "https://wordpress.org/plugins/backwpup/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/backwpup",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-07"
 }
}