CVE-2026-86815

Name of the Vulnerable Software and Affected Versions BackWPup versions 5.2.2 through 5.7.4

Description An authorization flaw exists in the REST API routes used for managing backup jobs, backup destinations, and backup execution. This issue allows an authenticated user with a limited role assigned by an administrator to bypass intended permission boundaries. An attacker can exploit this gap to create or modify backup jobs and redirect a full WordPress database backup to a destination under their control, leading to data exfiltration.

Recommendations Update BackWPup to version 5.7.5 or later. Review all users with BackWPup capabilities, recently created backup jobs, and newly added destinations for unauthorized activity. Rotate credentials if an unauthorized database copy is suspected to have been exfiltrated.