CVE-2025-26779: Keep Backup Daily Path Traversal Flaw

CVE-2025-26779 Overview

CVE-2025-26779 is a path traversal vulnerability in the Fahad Mahmood Keep Backup Daily WordPress plugin. The flaw affects all versions of keep-backup-daily up to and including 2.1.0. An authenticated attacker with high privileges can abuse the plugin to download arbitrary files from the underlying WordPress server. The issue is tracked under CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Attackers with high-privilege WordPress access can read arbitrary files on the host, exposing wp-config.php credentials, backup archives, and other sensitive server data.

Affected Products

Fahad Mahmood Keep Backup Daily plugin for WordPress
All versions from initial release through 2.1.0
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-02-16 - CVE-2025-26779 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26779

Vulnerability Analysis

The Keep Backup Daily plugin exposes functionality that accepts a file path parameter and returns the corresponding file contents. The plugin fails to properly restrict the pathname to a designated backup directory. As documented in the Patchstack Vulnerability Report, an authenticated user can traverse outside the intended directory and retrieve arbitrary files. Exploitation requires high-privilege authentication, limiting the vulnerability to administrators or accounts with equivalent capabilities. Successful exploitation impacts confidentiality only; integrity and availability of the site remain intact.

Root Cause

The root cause is missing or insufficient sanitization of a filename parameter used by the plugin's backup download handler. The handler concatenates user-supplied input into a filesystem path without normalizing traversal sequences such as ../. This allows the resulting path to escape the intended backup storage directory.

Attack Vector

An authenticated administrator sends a crafted HTTP request to the plugin endpoint responsible for retrieving backup files. By supplying directory traversal sequences in the file parameter, the attacker forces the plugin to read files outside the backup directory. Common targets include wp-config.php, which stores database credentials and secret keys, as well as /etc/passwd on Linux hosts. The attack vector is network-based and does not require user interaction beyond the attacker's own session.

No verified proof-of-concept code has been published. Refer to the Patchstack advisory for technical details on the vulnerable endpoint.

Detection Methods for CVE-2025-26779

Indicators of Compromise

HTTP requests to Keep Backup Daily plugin endpoints containing ../ sequences or URL-encoded variants such as %2e%2e%2f
Access log entries showing plugin download handlers returning non-backup files
Unexpected reads of wp-config.php, .htaccess, or system files traced to the WordPress process
Presence of keep-backup-daily plugin at version 2.1.0 or earlier in the wp-content/plugins/ directory

Detection Strategies

Inspect web server access logs for requests targeting plugin PHP files with suspicious file, path, or filename parameters
Deploy a web application firewall rule to flag path traversal patterns directed at /wp-content/plugins/keep-backup-daily/
Audit WordPress administrator accounts for unexplained downloads or session activity

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php and other sensitive WordPress files to detect unauthorized reads
Aggregate WordPress and web server logs into a centralized platform for query-based hunting on plugin endpoints
Track outbound data transfer volume from WordPress hosts to identify bulk file exfiltration

How to Mitigate CVE-2025-26779

Immediate Actions Required

Deactivate and remove the Keep Backup Daily plugin until a patched release is confirmed
Rotate WordPress database credentials, authentication salts, and any API keys stored in wp-config.php
Review administrator accounts and revoke access for any that are unrecognized or unnecessary
Restrict access to the WordPress admin panel by source IP where feasible

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 2.1.0 as affected with no fixed version identified. Site owners should monitor the plugin's WordPress.org page for an updated release and apply it as soon as it is available.

Workarounds

Remove the plugin entirely and use an alternative backup solution with active maintenance
Apply web application firewall rules that block path traversal payloads to plugin URLs
Enforce strict least-privilege policies so that administrator accounts are limited in number and protected with multi-factor authentication

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate keep-backup-daily
wp plugin delete keep-backup-daily