CVE-2026-1311: WordPress Worry Proof Backup Path Traversal

CVE-2026-1311 Overview

The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This vulnerability allows authenticated attackers with Subscriber-level access or higher to upload a malicious ZIP archive containing path traversal sequences. Successful exploitation enables arbitrary file writes anywhere on the server, including executable PHP files, ultimately leading to remote code execution.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can achieve complete server compromise through arbitrary file upload and remote code execution.

Affected Products

• Worry Proof Backup WordPress Plugin versions ≤ 0.2.4
• WordPress installations with the Worry Proof Backup plugin enabled
• Servers hosting WordPress with subscriber-level user registration enabled

Discovery Timeline

• 2026-02-26 - CVE-2026-1311 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-1311

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), which occurs when the application fails to properly sanitize user-supplied input that is used to construct file paths. In the context of the Worry Proof Backup plugin, the backup upload functionality does not adequately validate the file paths within uploaded ZIP archives before extraction.

The vulnerability is exploitable over the network and requires only low-privilege authentication (Subscriber-level access). Once exploited, an attacker gains the ability to write arbitrary files to any location on the server filesystem accessible by the web server process, resulting in complete compromise of confidentiality, integrity, and availability.

Root Cause

The root cause lies in the upload-backup.php file located at inc/libs/upload-backup.php (line 97). The backup upload handler processes ZIP archives without properly sanitizing or validating the file paths contained within the archive. When extracting files, the plugin fails to check for path traversal sequences such as ../ within the ZIP archive's internal file paths, allowing attackers to escape the intended upload directory and write files to arbitrary locations on the server.

Attack Vector

The attack vector involves authenticated users exploiting the backup upload functionality through the following mechanism:

1. An attacker authenticates to WordPress with at least Subscriber-level privileges
2. The attacker crafts a malicious ZIP archive containing files with path traversal sequences in their filenames (e.g., ../../../wp-content/plugins/malicious.php)
3. The attacker uploads the malicious ZIP archive through the plugin's backup upload interface
4. The plugin extracts the archive without proper path validation
5. Files are written outside the intended directory, potentially including executable PHP files in web-accessible locations
6. The attacker accesses the uploaded PHP file to achieve remote code execution

The vulnerability in the backup upload functionality can be understood through the file extraction process. When the plugin extracts files from a user-uploaded ZIP archive, it fails to validate that the target path remains within the intended backup directory. Path traversal sequences like ../ within the ZIP archive's internal file paths allow attackers to write files to arbitrary locations. For technical details, see the WordPress Plugin File Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1311

Indicators of Compromise

• Unexpected PHP files appearing in web-accessible directories outside the plugin's backup folder
• Web server logs showing access to newly created PHP files not part of the standard WordPress installation
• ZIP file uploads through the Worry Proof Backup plugin from low-privilege user accounts
• File system changes in directories outside the expected backup storage location

Detection Strategies

• Monitor file creation events in WordPress directories, especially wp-content, wp-includes, and the web root for unexpected PHP files
• Implement web application firewall (WAF) rules to detect and block ZIP uploads containing path traversal sequences
• Review web server access logs for suspicious requests to the backup upload endpoint from subscriber-level accounts
• Deploy file integrity monitoring to detect unauthorized file modifications or creations

Monitoring Recommendations

• Enable detailed logging for the Worry Proof Backup plugin's upload functionality
• Configure SentinelOne's endpoint protection to monitor for suspicious PHP file creation events outside normal WordPress operations
• Set up alerts for any file writes to sensitive WordPress directories by the web server process
• Monitor authentication logs for unusual subscriber-level account activity related to backup operations

How to Mitigate CVE-2026-1311

Immediate Actions Required

• Disable or remove the Worry Proof Backup plugin immediately if running version 0.2.4 or earlier
• Audit the WordPress file system for any unexpected PHP files that may have been uploaded by attackers
• Review user accounts with Subscriber-level or higher access for any suspicious activity
• Temporarily disable user registration if not required for business operations
• Implement web application firewall rules to block malicious ZIP uploads

Patch Information

At the time of publication, organizations should check for an updated version of the Worry Proof Backup plugin that addresses this vulnerability. Refer to the WordPress Plugin Repository for the latest version information. Until a patch is available, it is strongly recommended to disable or remove the plugin entirely.

Workarounds

• Disable the Worry Proof Backup plugin until a patched version is released
• Restrict subscriber-level user registration to minimize potential attack surface
• Implement server-level file upload restrictions to prevent ZIP file uploads to the vulnerable endpoint
• Configure PHP's open_basedir directive to limit file operations to specific directories
• Deploy SentinelOne endpoint protection to detect and prevent malicious file creation activities

# Disable the Worry Proof Backup plugin via WP-CLI
wp plugin deactivate worry-proof-backup

# Scan for recently modified PHP files in WordPress directories
find /var/www/html -name "*.php" -mtime -7 -type f -exec ls -la {} \;

# Review file permissions and restrict write access
chmod 755 /var/www/html/wp-content
chmod 644 /var/www/html/wp-content/*.php