CVE-2026-86815

MediumCVSS 5.5/10Last modified Sep 11, 2026

Description

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-868165.3The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to CVE-2026-868174.9The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema fiel CVE-2026-868184.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. CVE-2026-868197.1Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients CVE-2026-86824.3The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versi CVE-2026-868235.3The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action CVE-2026-868244.8The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its trackin CVE-2026-868265.9The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, a CVE-2026-868275.3The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originate CVE-2026-868286.6The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when CVE-2026-86836.5Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App whic CVE-2026-868307.2Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 migh