medium6.6
CVE-2026-86828
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive…
Impact
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
Affected products
| Product | Affected versions |
|---|---|
| BackWPup WordPress Plugin | before 5.7.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.