CVE-2026-18386

Name of the Vulnerable Software and Affected Versions WP BackItUp Community Edition versions prior to 2.1.1

Description An issue exists where authenticated attackers with administrator-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside the web root folder. By manipulating the backup file parameter, an attacker can read arbitrary files on the server that may contain sensitive information. The basename() normalization in the handler fails to protect existing files because it only executes when the target path does not exist.

Recommendations Update WP BackItUp Community Edition to version 2.1.1 or later. Avoid using the backup file parameter until the plugin is updated.