# Keep Backup Daily <= 2.1.4 - Cross-Site Request Forgery to Backup Deletion

- **ID:** WPSEC-2026-2172
- **Plugin:** Keep Backup Daily (`keep-backup-daily`), https://wordpress.org/plugins/keep-backup-daily/
- **Affected versions:** all versions before 2.2.0
- **Fixed in:** 2.2.0 (Update to 2.2.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/keep-backup-daily
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2172/

## Description

The Keep Backup Daily plugin for WordPress is vulnerable to Cross-Site Request Forgery via the backup download page (kbd_force_download function) in all versions up to, and including, 2.1.4, due to missing nonce validation on the 'file' and 'rm' GET parameters. This makes it possible for unauthenticated attackers to delete database backups, or other .gz files in the root of the uploads directory, whose names they know, via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2172/
- https://plugins.svn.wordpress.org/keep-backup-daily/tags/2.2.0/
- https://wordpress.org/plugins/keep-backup-daily/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2172/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.