CVE-2026-6227

CVE-2026-6227：BackWPup 中的本地文件包含漏洞 公告摘要 BackWPup 5.6.6 及更早版本受到通过 /wp-json/backwpup/v1/getblock REST 端点的 blockname 参数引发的已认证本地文件包含（LFI）漏洞影响。 该缺陷由对遍历序列进行非递归 strreplace 清理所致，已在 5.6.7 版本中修复。 元数据 CVE：CVE-2026-6227 严重性：高 CVSS 评分：7.2 受影响产品：BackWPup WordPress 插件 受影响版本：= 5.6.6 修复版本：5.6.7 状态：已修补...

WordPress BackWPup plugin <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter vulnerability

Authenticated Administrator+ Local File Inclusion via 'blockname' Parameter vulnerability discovered by PixelDefaultBR - Think IT in WordPress Plugin BackWPup versions = 5.6.6...

CVE-2026-6227

The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive strreplace sanitization of path traversal sequences. This makes it possible for...