---
id: "CVE-2026-104307"
page: "https://infrastack.ai/live/CVE-2026-104307"
kind: "vulnerability"
aliases: ["CVE-2026-104307"]
title: "BackUpWordPress: any logged-in user can delete backup protection files"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backupwordpress", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-user-accounts", "plugin-version-3.15-or-later"]
published_at: "2026-11-08T06:17:03+00:00"
first_seen_at: "2026-11-08T06:46:21+00:00"
updated_at: "2026-11-08T06:47:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104307", "first_seen_at": "2026-11-08T06:46:21+00:00"}]
exploit_sources: []
---

# BackUpWordPress: any logged-in user can delete backup protection files

Link for people: https://infrastack.ai/live/CVE-2026-104307 (this .md is for agents)

The BackUpWordPress WordPress plugin before 3.15 has an AJAX action that cleans up its backup directory without checking the user's capability or a nonce. Any authenticated user, including a Subscriber, can delete the plugin's protection and working files, which removes download protection from stored backups and disrupts backups in progress.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BackUpWordPress version in the WordPress admin plugins list or in the plugin's main file header.
- Confirm whether subscriber-level accounts can register on the site.

## Fix

- BackUpWordPress `3.15` or later, per the advisory's stated affected range (before 3.15).

## Timeline

- 2026-11-08T06:46:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104307

## From the sources

The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_