BackWPup Plugin RCE Via Local File Inclusion

The National Vulnerability Database (NVD) has reported a critical Local File Inclusion (LFI) vulnerability, CVE-2026-6227, in the BackWPup plugin for WordPress. This flaw, present in all versions up to and including 5.6.6, stems from insufficient sanitization of path traversal sequences within the /wp-json/backwpup/v1/getblock REST endpoint. Specifically, a non-recursive str_replace() function fails to fully neutralize crafted traversal sequences like ....//.

This oversight allows authenticated attackers with Administrator-level access to include arbitrary PHP files on the server. While requiring high privileges, the NVD points out that administrators can delegate backup handling permissions to lower-level users, potentially broadening the attack surface. Successful exploitation can lead to the disclosure of sensitive data, such as wp-config.php, or, in certain configurations, achieve full remote code execution (RCE). The NVD has assigned this vulnerability a CVSS score of 7.2 (HIGH), underscoring its significant impact.