CVE-2026-1104: FastDup WordPress Auth Bypass Vulnerability

CVE-2026-1104 Overview

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress contains a critical authorization vulnerability due to a missing capability check on REST API endpoints. This vulnerability affects all versions up to and including 2.7.1, allowing authenticated attackers with Contributor-level access or above to create and download full-site backup archives. These backups can contain the entire WordPress installation, including database exports and sensitive configuration files such as wp-config.php.

Critical Impact
Authenticated attackers with minimal privileges (Contributor-level) can exfiltrate complete WordPress site backups including database credentials, user information, and sensitive configuration data.

Affected Products

FastDup – Fastest WordPress Migration & Duplicator plugin versions ≤ 2.7.1
WordPress installations using vulnerable FastDup plugin versions

Discovery Timeline

2026-02-12 - CVE-2026-1104 published to NVD
2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-1104

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a broken access control flaw where the application fails to verify that a user has the required permissions to perform sensitive operations. In the context of the FastDup plugin, the REST API endpoints responsible for creating and downloading backup packages do not properly validate user capabilities before executing these operations.

The impact of this vulnerability is significant because backup archives typically contain complete copies of the WordPress installation, including the database with user credentials, plugin configurations, uploaded content, and the wp-config.php file which contains database connection strings and authentication keys. An attacker exploiting this vulnerability could gain access to sensitive information enabling further attacks such as database compromise, credential theft, or complete site takeover.

Root Cause

The root cause lies in the PackageApi.php file within the FastDup plugin's endpoint handling code. The REST API endpoints for backup creation and download operations lack proper capability checks that should verify the requesting user has administrative privileges before allowing access to these sensitive functions. WordPress provides capability checking functions such as current_user_can() that should be used to enforce authorization, but these checks are missing from the vulnerable code paths.

Attack Vector

The attack can be executed remotely over the network by any authenticated user with at least Contributor-level access to the WordPress installation. The attacker does not require any user interaction to exploit this vulnerability. The attack sequence involves:

Authenticating to the WordPress site with a low-privileged account (Contributor or higher)
Sending crafted REST API requests to the FastDup backup creation endpoints
Triggering a full-site backup generation without proper authorization checks
Downloading the resulting backup archive containing sensitive site data

The vulnerability is particularly dangerous in multi-user WordPress environments where untrusted users may have Contributor or Author roles, as these users would normally have no access to site backup functionality.

Detection Methods for CVE-2026-1104

Indicators of Compromise

Unexpected backup files appearing in the FastDup storage directories
REST API requests to FastDup endpoints from non-administrator users
Unusual network traffic patterns involving large file downloads from WordPress admin areas
Backup archive downloads logged for users without administrative privileges

Detection Strategies

Monitor WordPress REST API logs for requests to /wp-json/fastdup/ endpoints from low-privileged users
Implement file integrity monitoring on backup storage directories to detect unauthorized backup creation
Review WordPress user activity logs for backup-related actions by Contributor or Author accounts
Configure web application firewall (WAF) rules to alert on FastDup REST API access patterns

Monitoring Recommendations

Enable detailed logging for REST API requests in WordPress security plugins
Set up alerts for new file creation in FastDup's backup storage locations
Monitor for large outbound data transfers that may indicate backup exfiltration
Audit user accounts with Contributor-level access and above for suspicious activity

How to Mitigate CVE-2026-1104

Immediate Actions Required

Update FastDup plugin to a version newer than 2.7.1 immediately
Audit recent backup activity to identify any unauthorized backup creation or downloads
Review user accounts with Contributor or higher access for potential compromise
Consider temporarily disabling the FastDup plugin until patching is complete

Patch Information

The vulnerability was addressed in the FastDup plugin. Security patches are available through the official WordPress plugin repository. Administrators should update to the latest available version that includes the fix for this authorization bypass. The WordPress FastDup Change Log provides details on the security update.

Additional technical analysis is available from Wordfence Vulnerability Analysis and the vulnerable code can be reviewed at the WordPress FastDup Code Reference.

Workarounds

Restrict user registration and minimize accounts with Contributor-level access or higher
Implement additional authentication layers for WordPress REST API endpoints using security plugins
Use a Web Application Firewall (WAF) to block unauthorized access to FastDup API endpoints
Consider removing the FastDup plugin entirely if backup functionality is not critical until a patch is applied

bash

# Disable FastDup plugin via WP-CLI as a temporary mitigation
wp plugin deactivate fastdup

# List users with Contributor or higher roles for audit
wp user list --role=contributor,author,editor --fields=ID,user_login,user_email

# Check for recently created backup files (adjust path as needed)
find /var/www/html/wp-content/uploads/fastdup/ -type f -mtime -7 -ls