Unauthenticated Backup Job Execution in BackWPup WordPress Plugin

Executive Summary

This vulnerability affects the BackWPup WordPress plugin versions 3.3 to 5.7.6. It allows unauthenticated attackers to force any existing backup job to run immediately by exploiting a flaw in the plugin's cron-triggered backup execution handler. The plugin does not verify if requests originate from WordPress's internal scheduled-event dispatch, enabling unauthorized execution of backup jobs regardless of their configured schedule or trigger type.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the BackWPup plugin in your WordPress admin panel. If it is between 3.3 and 5.7.6, the system is vulnerable. Look for unexpected backup job executions in logs or server activity.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could force backup jobs to run at any time, potentially causing unexpected server load, resource consumption, or interference with legitimate scheduled backups. This may disrupt normal operations and lead to performance issues or downtime on the affected WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to backup data. If attackers force backup jobs to run, they may exfiltrate sensitive data stored in backups, violating data protection requirements under GDPR (e.g., unauthorized access) and HIPAA (e.g., integrity and confidentiality of protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Update the BackWPup plugin to version 5.7.7 or later immediately. If updating is not possible, disable the plugin until the update is applied to prevent unauthorized backup executions.

Useful 0 Not Useful 0