CVE-2026-86827 — BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled…
Published: 2026-10-08 · CVSS: 5.3 · CVSS 3.1
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7