PT-2026-26714 · WordPress · Keep Backup Daily

San6051 · Publicado 2026-03-20 · Atualizado 2026-03-21 · CVE-2026-3339

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keep Backup Daily plugin for WordPress versions up to and including 2.1.1

Description The Keep Backup Daily plugin for WordPress is susceptible to a Limited Path Traversal issue. This is a result of inadequate validation of the kbd path parameter within the kbd open upload dir AJAX action, where only sanitize text field() is used for sanitization. This insufficient sanitization allows authenticated attackers with Administrator-level access or higher to potentially list the contents of directories outside the intended uploads directory on the server.

Recommendations Versions prior to and including 2.1.1 should be updated.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-3339

Produtos afetados

Keep Backup Daily

Referências · 7

• https://plugins.trac.wordpress.org/browser/keep-backup-daily/trunk/inc/functions.php#L855 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481587%40keep-backup-daily&new=3481587%40keep-backup-daily&sfp_email=&sfph_mail= · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/01984754-e332-4500-99a2-10a7b79967f5?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L871 · Nota
• https://twitter.com/CVEnew/status/2035262104265982411 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L855 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3339 · Nota de Segurança