Description

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-11T07:16:47.833Z",
  "pubdate": "2026-09-11T07:16:47.833Z",
  "executiveSummary": "The BackWPup WordPress plugin, in versions prior to 5.7.5, contains an improper access control vulnerability within its REST API implementation.\nThis vulnerability allows authenticated users with limited, administrator-assigned roles to perform unauthorized administrative actions, specifically the creation and execution of backup jobs.\nThe flaw stems from insufficient authorization checks on specific REST API endpoints, which fail to enforce strict capability mapping for non-administrator users.\nThe primary impact is the unauthorized exfiltration of sensitive database backups to attacker-controlled destinations.\nThis represents a significant risk to data confidentiality and integrity, as attackers can obtain complete database dumps without possessing full administrative privileges.\nExploitation requires the attacker to hold a legitimate, albeit limited, WordPress user account previously configured with BackWPup-specific roles, enabling them to abuse these improperly secured API routes.",
  "technicalDetails": "The root cause of this vulnerability is improper access control within the BackWPup REST API infrastructure. The plugin fails to adequately validate the privileges of users interacting with specific API routes designed for managing job configurations, backup destinations, and job execution workflows.\nAffected components include the REST API endpoints associated with job management and execution routines. While these endpoints are intended to be restricted to high-level administrative users, the implementation uses flawed authorization logic that erroneously permits users with limited BackWPup-assigned roles to access these privileged functions.\nThe exploitation flow begins with the attacker authenticating into the WordPress environment using a compromised account assigned a limited plugin-specific role. Once authenticated, the attacker crafts malicious HTTP requests directed at the BackWPup REST API routes. Because the backend fails to verify if the requester possesses the 'manage_options' or equivalent high-level capabilities, the server processes the requests as authorized.\nAn attacker can leverage these endpoints to modify existing job settings or create new jobs. Specifically, the attacker can manipulate the backup destination configuration to point to an external, attacker-controlled server. Subsequently, the attacker can trigger the backup execution routine via the REST API.\nThe post-exploitation behavior involves the plugin generating a full database backup and automatically transferring the resulting file to the malicious destination. This exfiltration process results in the exposure of potentially sensitive information, including user credentials, personal data, and configuration details stored within the WordPress database.\nThe vulnerability affects all BackWPup versions prior to 5.7.5. It does not require remote code execution (RCE) to achieve data exfiltration, as the intended functionality of the plugin is abused to perform the data transfer. The exposure is limited to authenticated users; however, it effectively facilitates privilege escalation in the context of plugin capabilities, as the security boundary intended to segment administrative tasks from limited user tasks is circumvented entirely."
}