CVE-2026-3339: WordPress Keep Backup Plugin Path Traversal

CVE-2026-3339 Overview

The Keep Backup Daily plugin for WordPress contains a Limited Path Traversal vulnerability affecting all versions up to and including 2.1.1. The vulnerability exists in the kbd_open_upload_dir AJAX action due to insufficient validation of the kbd_path parameter. The parameter is only sanitized using sanitize_text_field(), a WordPress function that does not remove path traversal sequences such as ../. This oversight allows authenticated attackers with Administrator-level privileges or higher to list the contents of arbitrary directories on the server outside of the intended uploads directory.

Critical Impact

Authenticated administrators can exploit this path traversal flaw to enumerate sensitive directory contents on the web server, potentially exposing configuration files, credentials, or other sensitive data that could facilitate further attacks.

Affected Products

• Keep Backup Daily WordPress Plugin versions up to and including 2.1.1

Discovery Timeline

• 2026-03-21 - CVE-2026-3339 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3339

Vulnerability Analysis

This path traversal vulnerability (CWE-22) arises from improper input validation in the Keep Backup Daily plugin's file management functionality. The kbd_open_upload_dir AJAX action accepts a kbd_path parameter that allows administrators to browse backup directories. However, the plugin relies solely on WordPress's sanitize_text_field() function to sanitize the input.

The sanitize_text_field() function is designed for general text sanitization—removing unwanted whitespace, HTML tags, and encoding special characters. It does not filter path traversal sequences like ../ or ..\, which are essential to prevent directory traversal attacks. As a result, an attacker with administrative credentials can supply a manipulated path containing traversal sequences to navigate outside the intended uploads directory and list contents of arbitrary server directories.

While this vulnerability requires administrator-level authentication, it still poses a security risk in multi-admin environments or situations where admin credentials are compromised, as it enables reconnaissance of the server's file system structure.

Root Cause

The root cause of this vulnerability is the use of an inappropriate sanitization function for path validation. The sanitize_text_field() function is not designed to handle file path security concerns. Proper path validation should include:

• Canonicalizing the path to resolve traversal sequences
• Validating that the resolved path remains within the intended directory boundary
• Implementing allowlisting for permitted directories
• Using WordPress's realpath() or similar functions to resolve the actual filesystem path before comparison

Attack Vector

The attack vector involves sending a crafted AJAX request to the WordPress admin interface. An authenticated administrator can manipulate the kbd_path parameter in the kbd_open_upload_dir AJAX action to include path traversal sequences. The vulnerability is exploitable over the network, requiring no user interaction beyond the attacker having valid administrator credentials.

The attacker constructs a request where the kbd_path parameter contains sequences like ../../../ to traverse up the directory tree from the uploads folder. The server then returns a directory listing of the target path, exposing filenames and potentially sensitive directory structures.

For example, an attacker could traverse to /etc/ on Linux systems or other sensitive directories to enumerate configuration files, identify installed software, or discover additional attack vectors. Technical details of the vulnerable code can be found in the WordPress Plugin Code at line 855 and line 871.

Detection Methods for CVE-2026-3339

Indicators of Compromise

• Unusual AJAX requests to admin-ajax.php with action kbd_open_upload_dir containing path traversal sequences (../, ..\)
• Web server logs showing repeated directory enumeration attempts with varying path depths
• Administrative activity logs revealing file system browsing outside the standard WordPress uploads directory
• Failed or successful access attempts to sensitive directories like /etc/, /var/, or Windows system directories

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor WordPress AJAX requests for suspicious kbd_path parameter values containing .. sequences
• Configure file integrity monitoring to alert on unexpected directory access patterns
• Enable verbose logging for WordPress AJAX actions and review for anomalous activity

Monitoring Recommendations

• Set up alerts for AJAX requests to kbd_open_upload_dir with non-standard path values
• Implement real-time log analysis to correlate multiple failed directory traversal attempts
• Monitor for administrator account activity anomalies that may indicate credential compromise
• Review WordPress plugin activity logs regularly for unexpected file system operations

How to Mitigate CVE-2026-3339

Immediate Actions Required

• Update the Keep Backup Daily plugin to a version newer than 2.1.1 that addresses this vulnerability
• Audit administrator accounts and ensure only trusted users have administrative access
• Review web server access logs for any historical exploitation attempts
• Consider temporarily disabling the Keep Backup Daily plugin until an update is applied

Patch Information

The plugin maintainers have released a fix for this vulnerability. The patch is available in the WordPress Plugin Change Log. Users should update to the latest version of the Keep Backup Daily plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

For additional details, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict administrative access to trusted IP addresses only using .htaccess or web server configuration
• Implement additional server-level path restrictions using open_basedir PHP directive
• Use a WAF rule to block requests containing path traversal patterns in the kbd_path parameter
• Consider using a security plugin to monitor and restrict suspicious AJAX activity

# Example Apache .htaccess rule to restrict admin access by IP
<Files admin-ajax.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>