CVE-2026-86826

MediumCVSS 5.9/10Last modified Oct 8, 2026

Description

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-868275.3The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originateCVE-2026-868286.6The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when CVE-2026-86836.5Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App whicCVE-2026-868307.2Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 mighCVE-2026-868318.7Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow anCVE-2026-868325.3The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to CVE-2026-868335.4The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body oCVE-2026-868343.7The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submissCVE-2026-868368.4In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaCVE-2026-868375.3The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthCVE-2026-868385.3The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointCVE-2026-868393.8The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requ
CVE-2026-86826: Medium severity, CVSS 5.9 | Vulnix