CVE-2026-1311: WordPress Worry Proof Backup Path Traversal

CVE-2026-1311 Overview

CVE-2026-1311 is a path traversal vulnerability [CWE-22] in the Worry Proof Backup plugin for WordPress, affecting all versions up to and including 0.2.4. The flaw resides in the backup upload functionality, which fails to sanitize file paths inside uploaded ZIP archives. Authenticated attackers with Subscriber-level access or higher can upload a malicious archive containing path traversal sequences. The plugin extracts the archive without restricting destination paths, allowing arbitrary file writes anywhere the web server user can reach. Attackers can drop PHP files into web-accessible directories, leading to remote code execution on the underlying server.

Critical Impact
Authenticated Subscriber-level users can achieve remote code execution on WordPress sites running Worry Proof Backup 0.2.4 or earlier by uploading crafted ZIP archives with path traversal sequences.

Affected Products

Worry Proof Backup plugin for WordPress, versions 0.2.4 and earlier
WordPress installations with the plugin activated
Any hosting environment where the plugin can write outside its intended backup directory

Discovery Timeline

2026-02-26 - CVE-2026-1311 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1311

Vulnerability Analysis

The vulnerability exists in the upload-backup.php component of the Worry Proof Backup plugin. The backup upload handler accepts ZIP archives from authenticated users but does not validate the entry names contained inside the archive before extraction. ZIP archives can embed file names containing relative path components such as ../, which during extraction resolve to directories outside the intended backup destination.

Because the plugin registers its upload endpoint with a low capability requirement, any user with Subscriber-level access can reach the affected code path. A WordPress Subscriber is the lowest privileged authenticated role, which significantly widens the pool of potential attackers on sites with open registration.

Once an attacker writes a PHP file into a web-accessible directory such as wp-content/uploads/ or the WordPress root, they can request the file directly through the web server to execute arbitrary PHP code. This converts a file write primitive into full remote code execution under the privileges of the web server process.

Root Cause

The root cause is missing sanitization of archive entry names during ZIP extraction in the backup upload routine. The plugin trusts the file paths declared inside the archive metadata and passes them directly to the file system write operation. See the WordPress Plugin Code Reference for the vulnerable code path.

Attack Vector

Exploitation is network-based and requires authentication at the Subscriber level or above. An attacker crafts a ZIP archive containing one or more entries whose names include ../ sequences, for example ../../../../wp-content/uploads/shell.php. The attacker logs in, submits the archive through the plugin's upload endpoint, and the plugin extracts the file to the traversed location. The attacker then requests the dropped PHP file through the web server to execute commands. No user interaction is required beyond the attacker's own session.

No verified public proof-of-concept code is referenced in the advisory. Technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1311

Indicators of Compromise

Unexpected PHP files appearing in wp-content/uploads/ or other writable directories outside the plugin's backup folder
ZIP archives uploaded by low-privilege accounts containing entry names with ../ sequences
HTTP POST requests to the plugin's upload-backup.php endpoint from Subscriber accounts
Outbound network connections initiated from the web server process shortly after a backup upload

Detection Strategies

Inspect web server access logs for POST requests to Worry Proof Backup upload endpoints originating from low-privilege user sessions
Scan the WordPress filesystem for recently modified PHP files outside expected plugin and theme directories
Parse stored ZIP archives and flag any entry whose normalized path escapes the intended extraction root
Correlate WordPress authentication events for Subscriber accounts with subsequent plugin upload activity

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and the wp-content/uploads/ directory
Alert on creation of .php, .phtml, or .phar files in upload directories that should contain only media
Monitor process creation by the web server user, particularly shells, curl, wget, and PHP exec family calls
Track newly registered WordPress accounts that immediately interact with backup or restore functionality

How to Mitigate CVE-2026-1311

Immediate Actions Required

Deactivate and remove the Worry Proof Backup plugin until a patched release is published and verified
Audit wp-content/uploads/ and the WordPress root for unauthorized PHP files and remove any that are not part of the legitimate installation
Disable open user registration or restrict the default new-user role to prevent untrusted Subscriber accounts
Review and rotate credentials, secrets, and API keys stored on the host if compromise is suspected

Patch Information

As of the last NVD update on 2026-04-15, all versions up to and including 0.2.4 are affected. Administrators should consult the Wordfence Vulnerability Report and the plugin's official WordPress.org listing for updated release information before reinstalling.

Workarounds

Remove the plugin entirely if a fixed version is not yet available
Restrict the plugin's upload endpoint at the web server or WAF layer to administrator IP addresses only
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
Enforce least-privilege roles and avoid granting Subscriber access to untrusted users on sites running this plugin

bash

# Apache: deny PHP execution in the uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

# Nginx: equivalent location block in the server config
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}