CVE-2026-101148

CriticalCVSS 10.0/10Last modified Oct 1, 2026

Description

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover.

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1011494.1Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-101154.3A vulnerability was identified in Open5GS up to 2.7.7. This affects an unknown part in the library lib/sbi/nnrf-handler.c of the component S CVE-2026-1011504.1Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary CVE-2026-1011514.3Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,CVE-2026-1011528.0Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clic CVE-2026-1011538.0On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user CVE-2026-1011547.2An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011559.1An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011568.4A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a c CVE-2026-1011578.7A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious con CVE-2026-1011588.4A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execut CVE-2026-1011597.5The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form,