WP Rollback <= 3.1.2 - Unauthenticated Sensitive Information Exposure via Predictable Backup Archive Paths
- ID
- WPSEC-2026-0684
- Plugin
- WP Rollback – Rollback Plugins and Themes (wp-rollback)
- Affected
- from 3.0.0 before 3.2.0
- Remediation
- Update to 3.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-09
- Attack surface
- WP Rollback on WPSec AttackSurface
- Fix released
- Published
Description
The WP Rollback plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 3.0.0 up to, and including, 3.1.2. Backup archives of premium (non-WordPress.org) plugins and themes, created when they are updated, were stored in the uploads directory under a fixed folder name with file names built from the plugin or theme slug and version, protected only by an .htaccess file. This makes it possible for unauthenticated attackers to download these backup archives on web servers that do not process .htaccess files, such as Nginx, exposing the files of the backed-up premium plugins and themes.
References
- https://wpsec.com/vuln/WPSEC-2026-0684/
- https://plugins.svn.wordpress.org/wp-rollback/tags/3.2.0/
- https://wordpress.org/plugins/wp-rollback/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS