CVE-2025-10579
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The BackWPup – WordPress Backup & Restore Plugin (versions up to and including 5.5.0) is vulnerable to unauthorized access of data due to a missing capability check on the 'backwpup_working' AJAX action. An authenticated attacker with Subscriber-level access or above can retrieve a backup's filename while a backup is running.
Risk Assessment
Disclosure of the backup filename could aid in a brute force attack to retrieve backup contents in limited environments (e.g., NGINX). This could lead to leakage of backup data.
Recommendation
Update the BackWPup plugin to a version later than 5.5.0 that fixes the vulnerability. Consider restricting access to backup files.
Other vulnerabilities in BackWPup
See all- CVE-2026-86828Medium
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
- CVE-2026-86827Medium
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
- CVE-2026-86826Medium
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
- CVE-2026-86815Medium
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a plugin-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.
- CVE-2026-65443High
A Cross Site Scripting (XSS) vulnerability in the BackWPup plugin for WordPress versions up to 5.7.4. An unauthenticated attacker can inject a malicious script.
Original NVD description (English source)
The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'backwpup_working' AJAX action in all versions up to, and including, 5.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve access to a back-up's filename while a backup is running. This information has little value on it's own, but could be used to aid in a brute force attack to retrieve back-up contents in limited environments (i.e. NGINX).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS