CVE-2026-3339 PUBLISHED

Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter

Assigner: Wordfence
Reserved: 27.02.2026 Published: 20.03.2026 Updated: 20.03.2026

The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the kbd_open_upload_dir AJAX action. This is due to insufficient validation of the kbd_path parameter, which is only sanitized with sanitize_text_field() - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 2.7

Product Status

Vendor fahadmahmood
Product Keep Backup Daily
Versions Default: unaffected
  • affected from * to 2.1.1 (incl.)

Credits

  • san6051 finder

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE