CVE-2026-101148

Name of the Vulnerable Software and Affected Versions BackupSheep WordPress Backup Plugin versions prior to 1.9

Description The plugin fails to properly validate its integration key, treating a blank or unset key as valid. This allows unauthenticated attackers to access backup and export endpoints to create and download full site backups, which include the database and user password hashes. Additionally, attackers can trigger file deletion actions on the server, potentially leading to sensitive data disclosure and complete site takeover.

Recommendations Remove the plugin from any site where it is installed.