CVE-2026-86827 BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

WordPress BackWPup plugin 3.3-5.7.6 - Unauthenticated Backup Job Execution vulnerability

Unauthenticated Backup Job Execution vulnerability discovered by Duy Tran in WordPress Plugin BackWPup versions 3.3-5.7.6...

CVE-2026-86827

The BackWPup WordPress plugin (versions 3.3 through 5.7.6 ) contains a vulnerability where it fails to verify if requests to its cron-triggered backup execution handler originate from the internal WordPress scheduled-event dispatch. This allows unauthenticated attackers to force any existing back...