BackWPup – WordPress Backup & Restore Plugin

WordPress plugin · backwpup · WordPress.org ↗

Latest v5.7.6 Last release Sep 7, 2026 Tested up to WP 7.1 400,000+ active installs

Critical

High

Known total

Unfixed

Running BackWPup – WordPress Backup & Restore Plugin on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.1	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 5.7.5 WPVulnerability	< 5.7.5	v5.7.5	CVE-2026-65443	Jul 27, 2026
HIGH CVSS 7.2	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 5.6.3 WPVulnerability	< 5.6.3	v5.6.3	CVE-2025-15041	Feb 18, 2026
HIGH CVSS 7.5	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 4.0.4 WPVulnerability	< 4.0.4	v4.0.4	CVE-2023-7164	Dec 18, 2023
HIGH CVSS 8.7	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 4.0.2 WPVulnerability	< 4.0.2	v4.0.2	CVE-2023-5504	Nov 22, 2023
HIGH CVSS 7.5	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 3.4.2 WPVulnerability	< 3.4.2	v3.4.2	CVE-2017-2551	Sep 8, 2017
MEDIUM CVSS 6.6	BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback CVE.org	>=0, <5.7.7	v5.7.7	CVE-2026-86828	Oct 8, 2026
MEDIUM CVSS 5.3	BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php CVE.org	>=3.3, <5.7.7	v5.7.7	CVE-2026-86827	Oct 8, 2026
MEDIUM CVSS 5.9	BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX CVE.org	>=0, <5.7.7	v5.7.7	CVE-2026-86826	Oct 8, 2026
MEDIUM CVSS 5.5	BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes CVE.org	>=5.2.2, <5.7.5	v5.7.5	CVE-2026-86815	Sep 11, 2026
MEDIUM CVSS 5.3	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 5.5.1 WPVulnerability	< 5.5.1	v5.5.1	CVE-2025-10579	Oct 24, 2025
MEDIUM CVSS 6.8	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 4.0.2 WPVulnerability	< 4.0.2	v4.0.2	CVE-2023-5505	Aug 16, 2024
LOW CVSS 2.7	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 4.0.3 WPVulnerability	< 4.0.3	v4.0.3	CVE-2023-5775	Feb 23, 2024
NONE CVSS 0.0	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 3.0.13 WPVulnerability	< 3.0.13	v3.0.13	CVE-2013-4626	Jun 19, 2013
NONE CVSS 0.0	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 1.7.2 WPVulnerability	< 1.7.2	v1.7.2	CVE-2011-4342	Mar 28, 2011
NONE CVSS 0.0	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 1.4.1 WPVulnerability	< 1.4.1	v1.4.1	CVE-2011-5208	Mar 2, 2011
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 5.7.7 WPVulnerability	< 5.7.7	v5.7.7	CVE-2026-86826	Oct 8, 2026
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] >= 3.3 - < 5.7.7 WPVulnerability	>= 3.3, < 5.7.7	v5.7.7	CVE-2026-86827	Oct 8, 2026
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 5.7.7 WPVulnerability	< 5.7.7	v5.7.7	CVE-2026-86828	Oct 8, 2026
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] >= 5.2.2 - < 5.7.5 WPVulnerability	>= 5.2.2, < 5.7.5	v5.7.5	CVE-2026-86815	Jul 27, 2026
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 5.6.7 WPVulnerability	< 5.6.7	v5.6.7	CVE-2026-6227	Apr 13, 2026
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 3.4.2 WPVulnerability	< 3.4.2	v3.4.2	—	Sep 28, 2017
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 3.3 WPVulnerability	< 3.3	v3.3	—	Mar 22, 2017
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 1.7.2 WPVulnerability	< 1.7.2	v1.7.2	—	May 15, 2015
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 2.1.5 WPVulnerability	< 2.1.5	v2.1.5	—	Oct 17, 2011
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 1.5 WPVulnerability	< 1.5	v1.5	—	Feb 28, 2011
UNKNOWN	BackWPup – WordPress Backup & Restore Plugin [backwpup] < 2.1.5 WPVulnerability	< 2.1.5	v2.1.5	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.