CVE-2026-104307 · Package
NO FIX YET · SEE WHAT TO DO
The BackUpWordPress WordPress plugin before 3.15 has an AJAX action that cleans up its backup directory without checking the user's capability or a nonce. Any authenticated user, including a Subscriber, can delete the plugin's protection and working files, which removes download protection from stored backups and disrupts backups in progress.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running BackUpWordPress before 3.15 that allow users to log in with any account, including subscriber accounts. Sites where registration is closed and only trusted administrators hold accounts face much less exposure. The flaw affects the plugin's backup directory protections rather than the site's core data.
Not affected if no-user-accounts, plugin-version-3.15-or-later
Who cares backupwordpress, self-hosted, wordpress
3.15 or later, per the advisory's stated affected range (before 3.15).The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.