Vulnerabilities / Keep Backup Daily / WPSEC-2026-2172
Keep Backup Daily <= 2.1.4 - Cross-Site Request Forgery to Backup Deletion
Medium 4.3
CWE-352Fixed in 2.2.0
- ID
- WPSEC-2026-2172
- Plugin
- Keep Backup Daily (keep-backup-daily)
- Affected
- all versions before 2.2.0
- Remediation
- Update to 2.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-31
- Attack surface
- Keep Backup Daily on WPSec AttackSurface
- Fix released
- Published
Description
The Keep Backup Daily plugin for WordPress is vulnerable to Cross-Site Request Forgery via the backup download page (kbd_force_download function) in all versions up to, and including, 2.1.4, due to missing nonce validation on the 'file' and 'rm' GET parameters. This makes it possible for unauthenticated attackers to delete database backups, or other .gz files in the root of the uploads directory, whose names they know, via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-2172/
- https://plugins.svn.wordpress.org/keep-backup-daily/tags/2.2.0/
- https://wordpress.org/plugins/keep-backup-daily/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS