{"id":"CVE-2026-104307","kind":"vulnerability","aliases":["CVE-2026-104307"],"related":[],"title":"BackUpWordPress: any logged-in user can delete backup protection files","description":"The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups.","summary":"The BackUpWordPress WordPress plugin before 3.15 has an AJAX action that cleans up its backup directory without checking the user's capability or a nonce. Any authenticated user, including a Subscriber, can delete the plugin's protection and working files, which removes download protection from stored backups and disrupts backups in progress.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backupwordpress","package","self-hosted","wordpress"],"not_affected_if":["no-user-accounts","plugin-version-3.15-or-later"],"how_to_check":"- Check the installed BackUpWordPress version in the WordPress admin plugins list or in the plugin's main file header.\n- Confirm whether subscriber-level accounts can register on the site.","fix":"- BackUpWordPress `3.15` or later, per the advisory's stated affected range (before 3.15).","status":"open","published_at":"2026-11-08T06:17:03+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:26+00:00","updated_at":"2026-11-08T06:47:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:26Z","model":"claude-haiku-5-5","output":{"fix":"- BackUpWordPress `3.15` or later, per the advisory's stated affected range (before 3.15).","reach":"internet","title":"BackUpWordPress: any logged-in user can delete backup protection files","impact":"low","summary":"The BackUpWordPress WordPress plugin before 3.15 has an AJAX action that cleans up its backup directory without checking the user's capability or a nonce. Any authenticated user, including a Subscriber, can delete the plugin's protection and working files, which removes download protection from stored backups and disrupts backups in progress.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","backupwordpress","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users delete backup protection files and disrupt backups","analyst_note":"","how_to_check":"- Check the installed BackUpWordPress version in the WordPress admin plugins list or in the plugin's main file header.\n- Confirm whether subscriber-level accounts can register on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-3.15-or-later","no-user-accounts"],"who_is_affected":"Sites running BackUpWordPress before 3.15 that allow users to log in with any account, including subscriber accounts. Sites where registration is closed and only trusted administrators hold accounts face much less exposure. The flaw affects the plugin's backup directory protections rather than the site's core data.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4568,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104307':14A,17A '-2026':13A,16A '3.15':29B,80C,112C 'action':33B,92C 'ajax':32B,91C 'allow':99C 'authent':50B,101C 'backup':9A,38B,70B,73B,97C,114C,124C,130C 'backupwordpress':1A,18B,25B,77C,109C 'capabl':45B,85C 'check':41B,88C 'clean':35B,94C 'cve':12A,15A 'delet':8A,56B,107C 'directori':39B,98C 'disrupt':72B,126C 'download':66B,120C 'file':11A,63B,118C 'host':22B 'in-progress':127C 'includ':52B 'log':4A 'logged-in':3A 'nonc':48B,87C 'packag':19B 'perform':83C 'plugin':27B,58B,78C,110C 'progress':75B,129C 'protect':10A,60B,67B,115C,121C 'remov':65B,119C 'self':21B 'self-host':20B 'store':69B,123C 'subscrib':54B,103C 'user':6A,43B,51B,102C 'without':40B 'wordpress':23B,26B 'work':62B,117C","nicknames":[],"mitigations":[],"who_affected":"Sites running BackUpWordPress before 3.15 that allow users to log in with any account, including subscriber accounts. Sites where registration is closed and only trusted administrators hold accounts face much less exposure. The flaw affects the plugin's backup directory protections rather than the site's core data.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backupwordpress","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-104307':14A,17A '-2026':13A,16A 'backup':9A 'backupwordpress':1A 'cve':12A,15A 'delet':8A 'file':11A 'log':4A 'logged-in':3A 'protect':10A 'user':6A","search_b":"'3.15':29B 'action':33B 'ajax':32B 'authent':50B 'backup':38B,70B,73B 'backupwordpress':18B,25B 'capabl':45B 'check':41B 'clean':35B 'delet':56B 'directori':39B 'disrupt':72B 'download':66B 'file':63B 'host':22B 'includ':52B 'nonc':48B 'packag':19B 'plugin':27B,58B 'progress':75B 'protect':60B,67B 'remov':65B 'self':21B 'self-host':20B 'store':69B 'subscrib':54B 'user':43B,51B 'without':40B 'wordpress':23B,26B 'work':62B","search_c":"'3.15':80C,112C 'action':92C 'ajax':91C 'allow':99C 'authent':101C 'backup':97C,114C,124C,130C 'backupwordpress':77C,109C 'capabl':85C 'check':88C 'clean':94C 'delet':107C 'directori':98C 'disrupt':126C 'download':120C 'file':118C 'in-progress':127C 'nonc':87C 'perform':83C 'plugin':78C,110C 'progress':129C 'protect':115C,121C 'remov':119C 'store':123C 'subscrib':103C 'user':102C 'work':117C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104307","severity":null,"published_at":"2026-11-08T06:17:03+00:00","modified_at":"2026-11-08T06:17:03+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}