CVE-2026-6227 PUBLISHED

BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

Assigner: Wordfence
Reserved: 13.04.2026 Published: 14.04.2026 Updated: 14.04.2026

The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive str_replace() sanitization of path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to include arbitrary PHP files on the server via crafted traversal sequences (e.g., ....//), which can be leveraged to read sensitive files such as wp-config.php or achieve remote code execution in certain configurations. Administrators have the ability to grant individual users permission to handle backups, which may then allow lower-level users to exploit this vulnerability.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor wp_media
Product BackWPup – WordPress Backup & Restore Plugin
Versions Default: unaffected
  • affected from 0 to 5.6.6 (incl.)

Credits

  • JOAO PEDRO VENTURA ALVES finder

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE