# BackWPup – WordPress Backup & Restore Plugin <= 5.7.6 - Missing Authorization to Unauthenticated Backup Job Execution

- **ID:** WPSEC-2026-0501
- **Plugin:** BackWPup – WordPress Backup & Restore Plugin (`backwpup`), https://wordpress.org/plugins/backwpup/
- **Affected versions:** from 3.3 before 5.7.7
- **Fixed in:** 5.7.7 (Update to 5.7.7 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/backwpup
- **Fix released:** 2026-10-05
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0501/

## Description

The BackWPup plugin for WordPress is vulnerable to unauthorized backup job execution in versions 3.3 up to, and including, 5.7.6. This is due to the BackWPup_Cron::cron_active() function accepting the internal 'cronrun' run type from the wp-cron.php?backwpup_run= request parameter and expecting an empty nonce for it, so the check passes when no nonce is supplied. This makes it possible for unauthenticated attackers to start any backup job by its numeric ID, including jobs that are disabled or that are meant to be started only through the key-protected external link. This consumes server resources and sends unwanted backups to the job's configured destinations. Because every run applies the job's backup retention limit, repeated runs can also cause older backups to be deleted.

## References

- https://wpsec.com/vuln/WPSEC-2026-0501/
- https://plugins.svn.wordpress.org/backwpup/tags/5.7.7/
- https://wordpress.org/plugins/backwpup/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0501/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.