CVE-2026-86828 — BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback

CVE-2026-86828

BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback PUBLISHED

Description (CNA)

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.

Affected (CNA)

Vendor / product	Versions
Unknown / BackWPup	affected 0 before 5.7.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/be8c0eab-1874-4490-b94e-394f62a522f3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.