PT-2026-20623 · WordPress · Backup/Restore Wordpress – Backup Plugin

Rafał · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-15041

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BackWPup – WordPress Backup & Restore Plugin versions prior to 5.6.3

Description The BackWPup – WordPress Backup & Restore Plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. A missing capability check within the save site option() function allows authenticated attackers with a level of access and above to modify arbitrary options on a WordPress site. This can be exploited to elevate privileges, for example, by changing the default registration role to administrator and enabling user registration, thereby granting attackers administrative access.

Recommendations Update BackWPup – WordPress Backup & Restore Plugin to version 5.6.3 or later.

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-15041

Produtos afetados

Backup/Restore Wordpress – Backup Plugin

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-15041 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3443073%40backwpup&new=3443073%40backwpup&sfp_email=&sfph_mail= · Nota
• https://twitter.com/CVEnew/status/2025892077683261536 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/backwpup/tags/5.6.1/src/Jobs/API/Rest.php?marks=88,337,788-812#L88 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/2ab8f440-2910-41a3-8bbc-afb4cafd33b5?source=cve · Nota