CVE-2026-6227: BackWPup Plugin Path Traversal Vulnerability

CVE-2026-6227 Overview

The BackWPup plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint. The vulnerability exists in all versions up to and including 5.6.6 due to improper sanitization of path traversal sequences using a non-recursive str_replace() function. This allows authenticated attackers with Administrator-level access to include arbitrary PHP files on the server via crafted traversal sequences (e.g., ....//), potentially leading to sensitive file exposure or remote code execution.

Critical Impact

Authenticated attackers with Administrator privileges can leverage this LFI vulnerability to read sensitive configuration files such as wp-config.php or achieve remote code execution in certain server configurations. The risk is compounded by the plugin's feature allowing administrators to grant backup handling permissions to lower-level users.

Affected Products

• BackWPup WordPress Plugin versions up to and including 5.6.6
• WordPress installations using vulnerable BackWPup versions
• Environments where backup permissions have been delegated to non-administrator users

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-6227 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-6227

Vulnerability Analysis

This vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The BackWPup plugin attempts to sanitize user input in the block_name parameter by using PHP's str_replace() function to remove path traversal sequences like ../. However, the implementation is fundamentally flawed because str_replace() operates non-recursively.

When an attacker supplies a crafted payload such as ....//, the function only removes the inner ../ sequence once, leaving behind ../ which then successfully traverses the directory structure. This allows attackers to escape the intended directory and access arbitrary files on the server filesystem.

The vulnerability is exposed through the REST API endpoint /wp-json/backwpup/v1/getblock, which is accessible to authenticated users with appropriate permissions. While the attack requires Administrator-level access by default, the plugin allows administrators to delegate backup handling permissions to lower-privileged users, expanding the potential attack surface.

Root Cause

The root cause is the use of a non-recursive str_replace() function for sanitizing path traversal sequences in the BackWPupHelpers.php file. This single-pass replacement approach fails to account for nested or compound traversal sequences that bypass the sanitization after partial removal. A secure implementation would require either recursive sanitization, proper path canonicalization, or allowlist-based validation of file paths.

Attack Vector

The attack is network-accessible and requires authentication with Administrator privileges or delegated backup permissions. An attacker would craft a malicious request to the REST endpoint containing nested path traversal sequences in the block_name parameter.

The exploitation flow involves:

1. Authenticating to WordPress with an account that has backup handling permissions
2. Sending a crafted request to /wp-json/backwpup/v1/getblock with a malicious block_name parameter
3. Using sequences like ....//....//....// to traverse out of the plugin directory
4. Targeting sensitive files such as wp-config.php for information disclosure or writable PHP files for code execution

Detection Methods for CVE-2026-6227

Indicators of Compromise

• HTTP requests to /wp-json/backwpup/v1/getblock containing path traversal patterns such as ....//, ..../, or similar obfuscated sequences
• Server logs showing REST API calls with unusual block_name parameter values containing directory traversal characters
• Unexpected file access events in server logs referencing files outside the plugin directory structure
• Access attempts to sensitive files like wp-config.php from the WordPress application context

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns including obfuscated variants like ....//, ..%2f%2f, and URL-encoded sequences
• Monitor REST API access logs for unusual patterns targeting the BackWPup endpoints, particularly requests with abnormally long or suspicious block_name parameters
• Deploy file integrity monitoring on critical WordPress files to detect unauthorized reads or modifications
• Enable verbose logging on the web server to capture full request URIs and parameters for forensic analysis

Monitoring Recommendations

• Configure SIEM alerts for requests containing nested path traversal sequences targeting WordPress REST API endpoints
• Establish baseline API usage patterns for the BackWPup plugin and alert on deviations
• Monitor for successful authentications followed by immediate REST API exploitation attempts
• Implement audit logging for all backup-related operations within the WordPress admin panel

How to Mitigate CVE-2026-6227

Immediate Actions Required

• Update BackWPup plugin to the latest patched version beyond 5.6.6 immediately
• Review and revoke any delegated backup permissions granted to non-administrator users until the patch is applied
• Audit access logs for any signs of exploitation attempts against the vulnerable endpoint
• Consider temporarily disabling the BackWPup plugin if an immediate update is not possible

Patch Information

A security patch addressing this vulnerability is available through the official WordPress plugin repository. The fix implements proper recursive sanitization and path validation to prevent traversal sequences from bypassing input filtering. Administrators should update to the latest version and verify the update was successful by checking the plugin version in the WordPress admin panel.

For technical details on the code changes, refer to the WordPress BackWPup Changeset Details. Additional vulnerability analysis is available from Wordfence Vulnerability Analysis.

Workarounds

• Restrict access to the WordPress REST API using server-level access controls or a security plugin until the patch can be applied
• Implement a WAF rule to block requests containing path traversal sequences to the /wp-json/backwpup/v1/ endpoint
• Remove backup handling permissions from all non-administrator users to limit the attack surface
• Consider using .htaccess or nginx configuration to restrict REST API access to trusted IP addresses only

# Example nginx configuration to restrict BackWPup REST API access
location ~* /wp-json/backwpup/ {
    allow 192.168.1.0/24;  # Trusted admin network
    deny all;
}