CVE-2026-6227
Local File Inclusion in BackWPup Plugin Enables RCE
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| backwpup | backwpup | to 5.6.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The BackWPup plugin for WordPress has a Local File Inclusion vulnerability in the `block_name` parameter of its `/wp-json/backwpup/v1/getblock` REST endpoint. This vulnerability exists in all versions up to and including 5.6.6 because the sanitization of path traversal sequences uses a non-recursive `str_replace()`, which is insufficient. As a result, authenticated users with Administrator-level access or higher can exploit this flaw by crafting traversal sequences (like `....//`) to include arbitrary PHP files on the server.
This can allow attackers to read sensitive files such as `wp-config.php` or, in some configurations, execute remote code. Additionally, since administrators can grant backup handling permissions to other users, lower-level users might also exploit this vulnerability if given such permissions.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to sensitive files and potential remote code execution on the affected server.
- Attackers with administrator or elevated permissions can read sensitive configuration files like `wp-config.php`.
- In certain server configurations, attackers may execute arbitrary PHP code remotely, leading to full system compromise.
- If administrators grant backup permissions to lower-level users, those users might also exploit this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated attackers with Administrator-level access to include arbitrary PHP files on the server, potentially leading to the reading of sensitive files such as wp-config.php or remote code execution.
Such unauthorized access to sensitive data and potential system compromise can negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive information and system integrity.