CVE-2026-104307

Name of the Vulnerable Software and Affected Versions BackUpWordPress versions prior to 3.15

Description Insufficient file path validation and a lack of capability or nonce checks on an AJAX action allow authenticated users with Subscriber level access and above to delete the backup directory. This action removes download protection from stored backups, disrupts backups currently in progress, and enables the deletion of arbitrary backup directories on the server.

Recommendations Update to version 3.15 or later.