CVE-2026-86828 — BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used,…
Published: 2026-10-08 · CVSS: 6.6 · CVSS 3.1
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7