PT-2026-7851 · WordPress · Wordpress+1

Athiwat Tiprasaharn + 2 · Publicado 2026-02-12 · Atualizado 2026-02-12 · CVE-2026-1104

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FastDup – Fastest WordPress Migration & Duplicator plugin versions up to 2.7.1

Description The FastDup plugin for WordPress is affected by a flaw that allows unauthorized backup creation and download. This is due to a missing capability check on REST API endpoints. Authenticated attackers with Contributor-level access or higher can create and download full-site backup archives, including database exports and configuration files. The affected API endpoints are not explicitly specified, but the issue relates to REST API functionality. The vulnerability allows access to the entire WordPress installation data.

Recommendations Versions prior to 2.7.1 should be updated to address this issue.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1104

Produtos afetados

Fastdup

Wordpress

Referências · 9

• https://plugins.trac.wordpress.org/browser/fastdup/trunk/includes/Endpoint/PackageApi.php#L371 · Nota
• https://plugins.trac.wordpress.org/changeset/3449530 · Nota
• https://twitter.com/CVEnew/status/2021980017274839238 · Publicação no Twitter
• https://t.me/CVEtracker/44536 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2022010645525201125 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2021975215283351881 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2021982226519302648 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/29c0fb4d-c38c-4c78-9e15-797f3c3a4b30?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1104 · Nota de Segurança