Unknown Backwpup vulnerabilities

4 CVEs affecting Unknown Backwpup, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86828, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-86828, published 2026-10-08. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing…
CVE-2026-86815, published 2026-09-11. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a…
CVE-2026-86827, published 2026-10-08. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch,…
CVE-2026-86826, published 2026-10-08. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do…