# WP Rollback <= 3.1.2 - Unauthenticated Sensitive Information Exposure via Predictable Backup Archive Paths

- **ID:** WPSEC-2026-0684
- **Plugin:** WP Rollback – Rollback Plugins and Themes (`wp-rollback`), https://wordpress.org/plugins/wp-rollback/
- **Affected versions:** from 3.0.0 before 3.2.0
- **Fixed in:** 3.2.0 (Update to 3.2.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-552
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-09)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-rollback
- **Fix released:** 2026-10-08
- **Published:** 2026-10-09
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0684/

## Description

The WP Rollback plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 3.0.0 up to, and including, 3.1.2. Backup archives of premium (non-WordPress.org) plugins and themes, created when they are updated, were stored in the uploads directory under a fixed folder name with file names built from the plugin or theme slug and version, protected only by an .htaccess file. This makes it possible for unauthenticated attackers to download these backup archives on web servers that do not process .htaccess files, such as Nginx, exposing the files of the backed-up premium plugins and themes.

## References

- https://wpsec.com/vuln/WPSEC-2026-0684/
- https://plugins.svn.wordpress.org/wp-rollback/tags/3.2.0/
- https://wordpress.org/plugins/wp-rollback/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0684/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.