CVE-2026-86815 Overview
CVE-2026-86815 is a missing authorization vulnerability [CWE-862] in the BackWPup WordPress plugin versions prior to 5.7.5. The plugin fails to properly restrict access to several REST API routes used for job, backup-destination, and backup-execution management. A user assigned a plugin-defined limited role by an administrator can create and run backup jobs. The attacker can then exfiltrate a full database backup to an attacker-controlled destination.
Critical Impact
A low-privileged WordPress user with a BackWPup limited role can exfiltrate full database backups containing sensitive site data, credentials, and user information to an external destination.
Affected Products
- BackWPup WordPress plugin versions prior to 5.7.5
- WordPress sites granting BackWPup-defined limited roles to non-administrator users
- Multisite WordPress installations using BackWPup for scheduled backups
Discovery Timeline
- 2026-09-11 - CVE-2026-86815 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-86815
Vulnerability Analysis
The vulnerability stems from insufficient authorization checks on BackWPup REST API endpoints. The plugin registers REST routes for managing backup jobs, backup destinations, and backup execution. These routes do not correctly verify whether the requesting user holds administrator privileges. Instead, the plugin accepts requests from users assigned a plugin-defined limited role, which an administrator can grant to any WordPress account.
A user with this limited role gains the ability to create new backup jobs, modify destination configurations, and trigger backup execution. Because BackWPup supports remote destinations such as S3, FTP, Dropbox, and email, an attacker can configure a job that writes a complete database backup to infrastructure they control. The database backup exposes user records, password hashes, session tokens, API keys stored in options, and any other sensitive data persisted by WordPress or its plugins.
Root Cause
The root cause is a missing authorization control [CWE-862] on REST API route handlers. The plugin conflates the presence of a plugin-assigned capability with authorization to perform backup operations. It does not enforce the WordPress manage_options or equivalent administrator check on state-changing routes.
Attack Vector
Exploitation requires the attacker to already hold a WordPress account with the BackWPup limited role. The attacker sends authenticated HTTP requests to the vulnerable REST API endpoints to create a backup job configured with an attacker-controlled destination. The attacker then invokes the execution route to run the job. See the WPScan Vulnerability Report for endpoint-level detail.
// No verified exploit code is publicly available.
// Refer to the WPScan advisory for endpoint and payload specifics.
Detection Methods for CVE-2026-86815
Indicators of Compromise
- Unexpected backup jobs appearing in the BackWPup configuration, particularly those pointing to unfamiliar remote destinations
- Outbound transfers from the WordPress host to unknown S3 buckets, FTP servers, Dropbox accounts, or SMTP relays
- REST API requests to BackWPup job, destination, or execution routes originating from non-administrator user sessions
- BackWPup log entries showing backup executions initiated by low-privileged accounts
Detection Strategies
- Audit WordPress user roles and identify accounts holding BackWPup-defined capabilities that are not organization administrators
- Review web server access logs for POST requests to /wp-json/backwpup/ routes correlated with non-admin session cookies
- Compare current BackWPup job and destination configurations against a known-good baseline
Monitoring Recommendations
- Enable WordPress audit logging to capture REST API calls and user capability changes
- Monitor egress network traffic from WordPress hosts for large outbound transfers to cloud storage providers
- Alert on creation or modification of BackWPup jobs and destinations outside of change windows
How to Mitigate CVE-2026-86815
Immediate Actions Required
- Upgrade the BackWPup plugin to version 5.7.5 or later on all WordPress installations
- Review all users assigned BackWPup limited roles and revoke access for accounts that do not require backup management
- Inspect BackWPup job and destination configurations for unauthorized entries and remove any attacker-controlled destinations
- Rotate credentials, API keys, and secrets stored in the WordPress database if unauthorized backup execution is suspected
Patch Information
The vendor addressed CVE-2026-86815 in BackWPup version 5.7.5 by adding proper authorization checks to the affected REST API routes. Administrators should update through the WordPress plugin management interface or WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict BackWPup capabilities to administrator accounts only until the plugin is updated
- Deactivate the BackWPup plugin on sites where upgrade cannot be performed immediately
- Block external requests to /wp-json/backwpup/ REST routes at the web application firewall for non-administrator sessions
# WP-CLI: update BackWPup to a fixed version and audit users with plugin capabilities
wp plugin update backwpup --version=5.7.5
wp user list --role=backwpup_admin --fields=ID,user_login,user_email
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
